Users with 2FA can have multiple sessions

Summary

While going live with additional 2FA options, a security researcher discovered that users that had enabled 2FA no longer executed regular logon hooks. Most of Legal Robot's logon hooks have no security impact, but one action logs out other sessions when a new session begins. While there is no specific vulnerability from this issue in isolation, an attacker could use this as part of a larger attack strategy.