Extension:OATHAuth implements two-factor authentication, and requires a token for users during the login process, if they have two-factor enabled. Unfortunately, it's necessary to put a token input on the initial login page, which is confusing for users who don't have two-factor enabled, or don't know what it is.
The proper solution for this is to have a challenge screen after the initial password login. MediaWiki doesn't have support for this. An extension can't display another screen before the authentication step completes, and once the authentication step completes, the user is logged in.
Version: 1.22.0
Severity: normal
See Also:
https://bugzilla.wikimedia.org/show_bug.cgi?id=42131