I have come across a two factor login mechanism using Time based OTP (TOTP). TOTP (6 digits) is shown to the user in an app.
There are two ways of logging in.
Method 1:
User inputs the username and password. Then approves the login notification received in the TOTP app. There is no need to enter the TOTP in this case.
username = username
password = password
Method 2:
User enters the concatenation of the password and TOTP from the app as the password. No notification is received in the app in this case.
username = username
password = password + TOTP (6 digit)
The username and password are sent over TLS.
On the server side, I am assuming they split the last 6 digits from the password value received and check if it matches the TOTP (and then match the rest of the string with the stored password).
Else, they hash the complete password and match it with the value stored in the database (assuming passwords are not stored in plain text). If it matches, a notification is sent to the user's device.
What can be the possible issues or crytographical weaknesses in this system?