An issue exists in Mattermost Server prior to 5.8.0. It mishandles brute-force attacks against MFA.
mattermost mattermost server