2FA bypass through flow and response manipulation

Test skipping the OTP step, replaying a success response, and whether backup codes or remember-me tokens are weaker.