Flaw in authentication

[martijnr17]

I'm using this plugin for years and it is working awesome but I was thinking how it works and think it has a big flaw. The 2factor "authStatus" is not tied to a session. So a hacker only have to test now and then to see if the mfa is already done and can also log in.