Hi @dse7i (dse7i)​ , Thank you for reaching out to the Okta Community! 

This is the expected behavior. Passwords are considered Authenticators under Okta Identity Engine and in a login flow which requires multiple Authenticators, each one is handled one at a time. 

While I think I understand your concern, this flow does not pose a security threat in itself. 

The worts case assumption here would be:

1. that the threat actor first has access to the old password of an account (common case with let’s say phishing)
2. an account which so happens to have the password expired at the time of the attack then to be able to get to the screen where they would get the “set up new password” screen (highly unlikely unless the expiration was triggered on purpose)
3. then also somehow bypass the account’s MFA. (again highly unlikely) 

I would also recommend always using additional stronger MFA options (not email, SMS, Voice Call) in all of your security policies. 

If my answer helped, remember to mark it as best to increase its visibility for other members of the Okta Community who might have the same questions as you. 

Hope my answer helps! 

--------------------------------

What you missed: new product releases and other announcements