Prevent validation using old OTP after resending new OTP

Please review and apply this patch

I checked the code and confirmed that when a new OTP is sent, it simply overwrites the old one in storage. This means the previous code is no longer valid and cannot be used. The module already works as expected, so no change is needed

I resent OTP but my first time login OTP also remains validated.

I re-tested this on my side, and the OTP flow works as expected:

The hash is constant (user ID + username + password hash + site salt).

As a result, every new OTP is stored under the same key.

This means the new OTP always overwrites the old one, so the previous code should not validate.

It would be really helpful if you could share a bit more about your setup so we can understand why you are seeing a different result:

Which version of the email_tfa module are you using?

The exact steps you followed when both codes worked.

With these details, we can better reproduce your case and confirm if there’s a specific scenario causing this behavior.

Thanks,
Abdulaziz