Logs mentioning your username in the relevant time frame: https://logstash.wikimedia.org/goto/1d891346190d4c750ec8b7e89803a0c9

One of the entries is OATHAuth user Huji entered a valid OTP, so most likely this was some kind of bug with the redirection after login (maybe T390784), combined with our surprising autologin behavior, and not a security issue.

We'll have a closer look, but I'm writing this just to reassure you :)

Thanks. Definitely reassuring.

centralauth-error-badtoken (if you see it on the local wiki) typically means that the login was successful but something went wrong with the redirect back to the local wiki afterwards. So yeah I think this is just a duplicate of T390784: Error when logging-in on auth.wikimedia.org: "The provided authentication token is either expired or invalid.".

Thanks for your followed up. I would argue that the phrase "The provided authentication token is either expired or invalid." does not mean "something went wrong with the redirect back to the local wiki" and so a separate message should be created and displayed in such circumstances.

And I have no issue with merging this with T390784 and/or with making this task public, if you deem appropriate.

The error is about an expired token that's used during authentication so technically the message is true, but you are right that "authentication token" sounds like it's about your password or 2FA token, when it's actually about an internal token, so the message could use improvement.