Authenticator is buggy. When they made it easy to report vulnerabilities back in 2016-17, a colleague and I were able to pretty trivially compromise the product about 5 times during a PoC - and we weren’t trying to do so!

The worst one involved hitting cancel 8 times in a certain window, which you let you in. Lol