TOTP MFA code that I never enrolled

[blaizooo]

I am being prompted for a TOTP MFA code that I never enrolled.
I log in to Supabase via GitHub OAuth (no password).
My GitHub account is accessible normally and I am signed in to GitHub right now.

I have no MFA secret/app configured for Supabase.
"Force sign out and clear cookies" does not help — after re-login via GitHub,
the same TOTP prompt blocks access to the Dashboard and even to /account/security (it redirects back to login after ~2s).

I even tried to reset the password, but to no avail. I've tried "Force sign out and clear cookies" with no success.
Sign-in method: GitHub OAuth

GitHub audit log confirms that the OAuth handshake completes successfully each time
I attempt to log in (token regenerated with user:email scope, oauth_application_name:
Supabase). The MFA prompt that locks me out is therefore strictly server-side at Supabase,
post-OAuth, with no MFA enrollment ever performed on my side.

[GaryAustin1]

Try a different device, but probably need to contact support@supabase.com

[jdpru]

same issue, so frustrating