Index: Bugzilla/Auth.pm
===================================================================
--- Bugzilla/Auth.pm
+++ Bugzilla/Auth.pm
@@ -105,7 +105,7 @@
       remember      => $params->{Bugzilla_remember},
       url           => $uri->as_string,
       postback =>
-        {action => 'token.cgi', token_field => 't', fields => {a => 'mfa_l',},}
+        {action => 'token.cgi', fields => {a => 'mfa_l',},}
     });
   }
 
Index: Bugzilla/MFA.pm
===================================================================
--- Bugzilla/MFA.pm
+++ Bugzilla/MFA.pm
@@ -69,9 +69,7 @@
   set_token_extra_data($token, $event);
 
   # trigger provider verification
-  my $token_field = $event->{postback}->{token_field} // 'mfa_token';
-  $event->{postback}->{fields}->{$token_field} = $token;
-  $self->prompt($event);
+  $self->prompt($event, $token);
   exit;
 }
 
Index: Bugzilla/MFA/TOTP.pm
===================================================================
--- Bugzilla/MFA/TOTP.pm
+++ Bugzilla/MFA/TOTP.pm
@@ -62,10 +62,19 @@
 }
 
 sub prompt {
-  my ($self, $vars) = @_;
+  my ($self, $vars, $token) = @_;
   my $template = Bugzilla->template;
+  my $cgi      = Bugzilla->cgi;
 
-  print Bugzilla->cgi->header();
+  # Set cookie with token to verify form submitted
+  # from Bugzilla and not a different domain.
+  $cgi->send_cookie(
+    -name     => 'mfa_verification_token',
+    -value    => $token,
+    -httponly => 1,
+  );
+
+  print $cgi->header();
   $template->process('mfa/totp/verify.html.tmpl', $vars)
     || ThrowTemplateError($template->error());
 }
Index: token.cgi
===================================================================
--- token.cgi
+++ token.cgi
@@ -180,10 +180,10 @@
   cancel_create_account($token);
 }
 elsif ($action eq 'mfa_l') {
-  verify_mfa_login($token);
+  verify_mfa_login();
 }
 elsif ($action eq 'mfa_p') {
-  verify_mfa_password($token);
+  verify_mfa_password();
 }
 elsif ($action eq 'verify_auto_account_creation') {
   verify_auto_account_creation($token);
@@ -248,7 +248,7 @@
       password => $password,
       token    => $token,
       postback =>
-        {action => 'token.cgi', token_field => 't', fields => {a => 'mfa_p',},},
+        {action => 'token.cgi', fields => {a => 'mfa_p',},},
     });
   }
   else {
@@ -257,7 +257,9 @@
 }
 
 sub verify_mfa_password {
-  my $token = shift;
+  my $cgi   = Bugzilla->cgi;
+  my $token = $cgi->cookie('mfa_verification_token');
+  $cgi->remove_cookie('mfa_verification_token');
   my ($user, $event) = mfa_event_from_token($token);
   set_user_password($event->{token}, $user, $event->{password});
 }
@@ -478,7 +480,9 @@
 }
 
 sub verify_mfa_login {
-  my $token = shift;
+  my $cgi   = Bugzilla->cgi;
+  my $token = $cgi->cookie('mfa_verification_token');
+  $cgi->remove_cookie('mfa_verification_token');
   my ($user, $event) = mfa_event_from_token($token);
   $user->authorizer->auto_verified($user, $event);