{"record":{"id":"3da6bfbb19a9689f","repo":"medusajs/medusa","slug":"mfa-factor-with-id-data-id-was-not-found","errorCode":null,"errorMessage":"MFA factor with id \"${data.id}\" was not found","messagePattern":"MFA factor with id \"(.+?)\" was not found","errorType":"exception","errorClass":"MedusaError","httpStatus":404,"severity":"error","filePath":"packages/modules/auth/src/services/auth-module.ts","lineNumber":403,"sourceCode":"    return await this.verifyAuthMfa_(data, sharedContext)\n  }\n\n  @InjectTransactionManager()\n  protected async verifyAuthMfa_(\n    data: AuthTypes.AuthMfaVerifyDTO,\n    @MedusaContext() sharedContext: Context = {}\n  ): Promise<AuthTypes.AuthMfaDTO> {\n    const factor = await this.authMfaFactorService_.retrieve(\n      data.id,\n      {},\n      sharedContext\n    )\n\n    if (\n      data.auth_identity_id &&\n      factor.auth_identity_id !== data.auth_identity_id\n    ) {\n      throw new MedusaError(\n        MedusaError.Types.NOT_FOUND,\n        `MFA factor with id \"${data.id}\" was not found`\n      )\n    }\n\n    const verifiedFactor = await this.authMfaProviderService_.verifySetup(\n      factor.provider,\n      data,\n      sharedContext\n    )\n\n    return verifiedFactor\n  }\n\n  @InjectManager()\n  async createAuthMfaChallenge(\n    data: AuthTypes.CreateAuthMfaChallengeDTO,\n    @MedusaContext() sharedContext: Context = {}","sourceCodeStart":385,"sourceCodeEnd":421,"githubUrl":"https://github.com/medusajs/medusa/blob/5e06e544a296b9033f20f71f11c559f81a0e5739/packages/modules/auth/src/services/auth-module.ts#L385-L421","documentation":"During MFA verification, the factor id was found but its auth_identity_id doesn't match the identity performing verification. The module reports this as NOT_FOUND to avoid leaking factor existence across identities.","triggerScenarios":"verifyAuthMfa({ id, auth_identity_id }) where the factor belongs to a different auth identity — e.g. stale factor id from another account/session, or a session mismatch after re-login.","commonSituations":"Frontend caches a factor id across logout/login of a different user; admin tooling passing the wrong identity id; JWT session pointing at a different identity than the stored UI state.","solutions":["Refetch the factor list for the current identity and use one of those ids","Clear cached MFA factor ids on logout/session change"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"const factors = await authModuleService.listAuthMfaFactors(currentIdentityId)\nconst factor = factors.find((f) => f.id === data.id)\nif (!factor) throw new Error('factor does not belong to current identity')","typeGuard":"const belongsToIdentity = (f: { auth_identity_id: string }, id: string) => f.auth_identity_id === id","tryCatchPattern":null,"preventionTips":["Always derive factor ids from the current session's identity","Clear cached MFA state on logout"],"tags":["auth","mfa","ownership"],"backgroundTag":"resource-not-found","analyzedSha":"5e06e544a296b9033f20f71f11c559f81a0e5739","analyzedAt":"2026-08-27T07:24:39.599Z","schemaVersion":2},"datasetVersion":"2026-08-27T08:17:20.692Z"}