We have found that the issue is consistently reproducible without Invantive software.
Steps to reproduce:
- Open this link: https://start.exactonline.nl/api/oauth2/auth?response_type=token&client_id=71418a04-dec6-4ca4-af78-954b588840f7&redirect_uri=https%3a%2f%2fexactonlineclientredirect.invantive.com&state=cce1ad89-312c-41ac-b087-95b156e64b1c
- Enter user name.
- Enter password.
The following error message is shown, even before a MFA-code is requested:
The verification code you entered is incorrect or has expired.
Please try again.
You have 10 attempts left before your account is temporarily blocked for 5 minutes.
Why doesn’t my code work?
The number “10” in the error clearly indicates no invalid MFA password has been provided yet, since all 10 attempts are still available.
The number “10” also clearly indicates that there is a (new) bug in the Exact Online. Our logging indicates that the problem occurs frequently, but not on all log on efforts.
The first occurrence was:
2022-09-05 00:18:29 UTC (West Europe: September 5, 2:18 in the morning)
The changes on the Exact Online log on leading to itgenobr113 errors do not have the same cause, although they are probably related. The itgenobr113 started September 7. It seems various changes are taken into production over time.