medusajs/medusa · error · MedusaError

MFA factor with id "${data.id}" was not found

Error message

MFA factor with id "${data.id}" was not found

What it means

During MFA verification, the factor id was found but its auth_identity_id doesn't match the identity performing verification. The module reports this as NOT_FOUND to avoid leaking factor existence across identities.

Source

Thrown at packages/modules/auth/src/services/auth-module.ts:403

    return await this.verifyAuthMfa_(data, sharedContext)
  }

  @InjectTransactionManager()
  protected async verifyAuthMfa_(
    data: AuthTypes.AuthMfaVerifyDTO,
    @MedusaContext() sharedContext: Context = {}
  ): Promise<AuthTypes.AuthMfaDTO> {
    const factor = await this.authMfaFactorService_.retrieve(
      data.id,
      {},
      sharedContext
    )

    if (
      data.auth_identity_id &&
      factor.auth_identity_id !== data.auth_identity_id
    ) {
      throw new MedusaError(
        MedusaError.Types.NOT_FOUND,
        `MFA factor with id "${data.id}" was not found`
      )
    }

    const verifiedFactor = await this.authMfaProviderService_.verifySetup(
      factor.provider,
      data,
      sharedContext
    )

    return verifiedFactor
  }

  @InjectManager()
  async createAuthMfaChallenge(
    data: AuthTypes.CreateAuthMfaChallengeDTO,
    @MedusaContext() sharedContext: Context = {}

View on GitHub (pinned to 5e06e544a2)

Solutions

1. Refetch the factor list for the current identity and use one of those ids
2. Clear cached MFA factor ids on logout/session change

const factors = await authModuleService.listAuthMfaFactors(currentIdentityId)
const factor = factors.find((f) => f.id === data.id)
if (!factor) throw new Error('factor does not belong to current identity')

const belongsToIdentity = (f: { auth_identity_id: string }, id: string) => f.auth_identity_id === id

When it happens

Trigger: verifyAuthMfa({ id, auth_identity_id }) where the factor belongs to a different auth identity — e.g. stale factor id from another account/session, or a session mismatch after re-login.

Common situations: Frontend caches a factor id across logout/login of a different user; admin tooling passing the wrong identity id; JWT session pointing at a different identity than the stored UI state.

Understand the failure class

Background: 'Could not be found', 'does not exist', 'not found in database': the resource-not-found family when an ID, slug, key, or URI lookup comes back empty — this error's family across 20 libraries.

Related errors

• INVALID_DATA
• NOT_ALLOWED
• An active TOTP factor already exists for this auth identity
• Only TOTP MFA factors can be verified with this method
• Disabled MFA factors cannot be verified

AI-assisted analysis of medusajs/medusa@5e06e544a2 (2026-08-27). Data as JSON: /api/errors/3da6bfbb19a9689f. Report an issue: GitHub.