medusajs/medusa · error · MedusaError

MFA challenge has too many failed attempts

Error message

MFA challenge has too many failed attempts

What it means

Verifying an MFA challenge failed and the attempt counter reached max_attempts, so the challenge is locked and the specific 'too many failed attempts' message is thrown (the counter is persisted via setMfaChallenge_ before throwing).

Source

Thrown at packages/modules/auth/src/services/auth-module.ts:500

    const valid = await this.authMfaProviderService_.verify(
      data.method,
      {
        auth_identity_id: challenge.auth_identity_id!,
        code: data.code,
      },
      sharedContext
    )

    if (!valid) {
      const attempts = challenge.attempts + 1

      await this.setMfaChallenge_({
        ...challenge,
        attempts,
      })

      throw new MedusaError(
        MedusaError.Types.NOT_ALLOWED,
        attempts >= challenge.max_attempts
          ? "MFA challenge has too many failed attempts"
          : "Invalid MFA challenge code"
      )
    }

    const completedChallenge: AuthTypes.AuthMfaChallengeDTO = {
      ...challenge,
      completed_at: new Date(),
    }

    await this.setMfaChallenge_(completedChallenge)

    return completedChallenge
  }

  @InjectManager()

View on GitHub (pinned to 5e06e544a2)

Solutions

1. Start a new MFA challenge (createAuthMfaChallenge) to get a fresh counter and code
2. Fix the underlying code generation issue (device time sync) before retrying
3. Treat lockout as a signal to rate-limit/cool down at the route level

try { await verifyAuthMfaChallenge(...) } catch (e) { if (e.message.includes('too many failed attempts')) { await createAuthMfaChallenge(...) /* fresh challenge */ } throw e }

When it happens

Trigger: verifyAuthMfaChallenge with wrong codes until attempts >= challenge.max_attempts (configured via MFA challenge config). Each wrong attempt increments the persisted counter.

Common situations: Brute-force guessing or a user repeatedly entering stale codes; authenticator drift making every attempt fail until lockout; automated tests hammering the endpoint.

Related errors

• INVALID_DATA
• NOT_ALLOWED
• An active TOTP factor already exists for this auth identity
• Only TOTP MFA factors can be verified with this method
• Disabled MFA factors cannot be verified

AI-assisted analysis of medusajs/medusa@5e06e544a2 (2026-08-27). Data as JSON: /api/errors/5c4e1a91b955a4fa. Report an issue: GitHub.