- Shipped
- November 15, 2026 at 1:52 AM UTC
- Author
- Kamo
- Commit
- ae85767
MfaController built the post-MFA redirect from its own request host (the shared api.* gateway) and dropped &org=, so an MFA sign-in on login.kamocrm.com?org=X landed on the platform workspace. It now reads the waiting session's org and asks **************** - the same builder the password path uses (own verified host, else the sign-in host's fallback; &org=<alias>). Anything unreadable keeps the old address. SignInCompletionService also gains complete(..., secondFactorProven) for a federated link confirmed with password + authenticator code (ID1.1).