Two-factor authentication is not active on this account
POST /api/auth/login/2fa found the pending cookie, but the user has no active authenticator (AUTH_2FA_NOT_ACTIVE). Pending cookie is cleared.
Why this happens
2FA was reset/disabled between password login and code submit, or data inconsistency. Distinct from wrong code and from session expired.
Diagnose and fix
1. Sign in with password again — if 2FA is off, login should complete without a code.
2. If the site requires 2FA, set up authenticator (mandatory flow may appear).
3. Staff: confirm user 2FA flags; Reset user 2FA / sessions if stuck.
4. Distinct from Set up Google Authenticator first (Account Settings enable path).