adversary-in-the-middle

TOTP doesn't fail. Your implementation does.

Why TOTP MFA gets bypassed: replay, wide skew windows, missing rate limits, seed theft, and origin-blind adversary-in-the-middle proxies.