Summary;
The 2FA activation process does not provide the user with a backup key or recovery code after enabling two-factor authentication.
If the user loses access to their authenticator device there is no any visible backup/recovery method available to regain access to the account...
Steps to Reproduce;
Log in to your account.
Navigate to Security / Two-Factor Authentication.
Enable 2FA.
Complete the activation process using an authenticator application.
Observe that no backup key or recovery codes are provided or configured.
Impact;
Users may permanently lose access to their accounts if they lose or reset the device containing their authenticator, potentially requiring manual account recovery.
Fix;
Provide users with securely generated, single-use recovery codes or a backup key during 2FA enrollment. Recovery codes should be displayed only once & stored securely by the user.