Sign in with Apple works on existing accounts, bypasses 2FA

Summary

It was possible to bypass configured Cloudflare 2FA when logging in to a Cloudflare account using Apple ID authentication flow. A malicious actor could access a Cloudflare account by setting up an Apple ID account using e-mail address matching the one used to set up the targeted account. The issue could affect customers who did not have an Apple ID account created with an e-mail address that was linked to their Cloudflare profile or whose Apple ID account was compromised by an attacker. The fix was released by the relevant engineering team that prevents such 2FA bypass attempts.