A challenge code is sent every 30 seconds even though it was already verified.
We used twilio for our MFA.
Auth0 Api is called via lambda backend function. Frontend invokes the lambda.
There is no indication that the lambda function was called like in the loop. There are just 2 invocations around that time… but our tester received more than 50 texts… it only stopped when we removed the associated mobile number from the user account of the tester.
Here are the logs from our environment:
Again
- recieved texts are more than 50. all with same MFA code
- Also, outgoing sms to the specific number, only 4 is logged by twilio.
- No indication in cloudwatch that the lambda function is called a lot of times. (2 invocations only)