The theoretical vulnerabilities quickly became practical threats:
Because traditional iframe authentication is obsolete, you must transition to or use a RADIUS with Automatic Push configuration. Automatic push bypasses the interactive browser window entirely, sending a mobile prompt as soon as the password checks out. duo hackcom sonic fixed
"Fixed" does not mean repaired. It means: the error has been accepted as the operating system. The duo agrees not to seek clarity, only friction. duo hackcom sonic fixed
— The Duo Security & Firmware Team