{"record":{"id":"ab576cbe7e9b22aa","repo":"medusajs/medusa","slug":"invalid-data-ab576c","errorCode":"INVALID_DATA","errorMessage":"MFA challenge is missing an auth identity","messagePattern":"MFA challenge is missing an auth identity","errorType":"exception","errorClass":"MedusaError","httpStatus":400,"severity":"error","filePath":"packages/medusa/src/api/auth/mfa/challenges/[id]/verify/route.ts","lineNumber":32,"sourceCode":"/**\n * @since 2.15.3\n */\nexport const POST = async (\n  req: AuthenticatedMedusaRequest<AuthMfaVerifyChallengeRequestType>,\n  res: MedusaResponse\n) => {\n  const { id } = req.params\n  const { method, code } = req.validatedBody\n\n  const authService = req.scope.resolve<IAuthModuleService>(Modules.AUTH)\n  const challenge = await authService.verifyAuthMfaChallenge({\n    id,\n    method,\n    code,\n  })\n\n  if (!challenge.auth_identity_id) {\n    throw new MedusaError(\n      MedusaError.Types.INVALID_DATA,\n      \"MFA challenge is missing an auth identity\"\n    )\n  }\n\n  const authIdentity = await authService.retrieveAuthIdentity(\n    challenge.auth_identity_id,\n    { relations: [\"provider_identities\"] }\n  )\n\n  if (\n    challenge.auth_provider &&\n    !authIdentity.provider_identities?.some(\n      (identity) => identity.provider === challenge.auth_provider\n    )\n  ) {\n    throw new MedusaError(\n      MedusaError.Types.INVALID_DATA,","sourceCodeStart":14,"sourceCodeEnd":50,"githubUrl":"https://github.com/medusajs/medusa/blob/5e06e544a296b9033f20f71f11c559f81a0e5739/packages/medusa/src/api/auth/mfa/challenges/[id]/verify/route.ts#L14-L50","documentation":"Thrown when verifying an MFA challenge whose auth_identity_id is empty. Every valid challenge must reference the auth identity it was issued for; a null id means the challenge record is malformed or was created without an authenticated context. Maps to HTTP 400 (INVALID_DATA).","triggerScenarios":"POST /auth/mfa/challenges/:id/verify where the challenge row has no auth_identity_id (seeded manually, corrupted, or created by an older version).","commonSituations":"Data corruption or manual DB edits to auth_mfa_challenge; challenges created before an upgrade that added the identity link; custom scripts inserting challenges directly.","solutions":["Delete/recreate the MFA challenge through the auth service API","Check for orphan challenge rows: SELECT * FROM auth_mfa_challenge WHERE auth_identity_id IS NULL","Start a fresh MFA challenge via the proper initiation endpoint","Verify you are on a current Medusa version where challenges always store auth_identity_id"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"catch (e) { if (e.type === 'invalid_data' && /missing an auth identity/.test(e.message)) restartMfaChallenge() else throw e }","preventionTips":["Create challenges only via the official endpoints","Audit challenge rows with NULL auth_identity_id","Expire stale challenges periodically"],"tags":["mfa","auth","invalid-data"],"backgroundTag":"mfa-challenge-invalid","analyzedSha":"5e06e544a296b9033f20f71f11c559f81a0e5739","analyzedAt":"2026-08-27T07:24:39.599Z","schemaVersion":2},"datasetVersion":"2026-08-27T08:17:20.692Z"}