Index: Bugzilla/Auth.pm
===================================================================
--- Bugzilla/Auth.pm
+++ Bugzilla/Auth.pm
@@ -105,7 +105,7 @@
       remember      => $params->{Bugzilla_remember},
       url           => $uri->as_string,
       postback =>
-        {action => 'token.cgi', token_field => 't', fields => {a => 'mfa_l',},}
+        {action => 'token.cgi', fields => {a => 'mfa_l',},}
     });
   }
 
Index: Bugzilla/MFA.pm
===================================================================
--- Bugzilla/MFA.pm
+++ Bugzilla/MFA.pm
@@ -69,9 +69,7 @@
   set_token_extra_data($token, $event);
 
   # trigger provider verification
-  my $token_field = $event->{postback}->{token_field} // 'mfa_token';
-  $event->{postback}->{fields}->{$token_field} = $token;
-  $self->prompt($event);
+  $self->prompt($event, $token);
   exit;
 }
 
Index: Bugzilla/MFA/TOTP.pm
===================================================================
--- Bugzilla/MFA/TOTP.pm
+++ Bugzilla/MFA/TOTP.pm
@@ -62,10 +62,19 @@
 }
 
 sub prompt {
-  my ($self, $vars) = @_;
+  my ($self, $vars, $token) = @_;
   my $template = Bugzilla->template;
+  my $cgi      = Bugzilla->cgi;
 
-  print Bugzilla->cgi->header();
+  # Set cookie with token to verify form submitted
+  # from Bugzilla and not a different domain.
+  $cgi->send_cookie(
+    -name     => 'mfa_verification_token',
+    -value    => $token,
+    -httponly => 1,
+  );
+
+  print $cgi->header();
   $template->process('mfa/totp/verify.html.tmpl', $vars)
     || ThrowTemplateError($template->error());
 }
Index: token.cgi
===================================================================
--- token.cgi
+++ token.cgi
@@ -180,10 +180,10 @@
   cancel_create_account($token);
 }
 elsif ($action eq 'mfa_l') {
-  verify_mfa_login($token);
+  verify_mfa_login();
 }
 elsif ($action eq 'mfa_p') {
-  verify_mfa_password($token);
+  verify_mfa_password();
 }
 elsif ($action eq 'verify_auto_account_creation') {
   verify_auto_account_creation($token);
@@ -248,7 +248,7 @@
       password => $password,
       token    => $token,
       postback =>
-        {action => 'token.cgi', token_field => 't', fields => {a => 'mfa_p',},},
+        {action => 'token.cgi', fields => {a => 'mfa_p',},},
     });
   }
   else {
@@ -257,7 +257,9 @@
 }
 
 sub verify_mfa_password {
-  my $token = shift;
+  my $cgi   = Bugzilla->cgi;
+  my $token = $cgi->cookie('mfa_verification_token');
+  $cgi->remove_cookie('mfa_verification_token');
   my ($user, $event) = mfa_event_from_token($token);
   set_user_password($event->{token}, $user, $event->{password});
 }
@@ -478,7 +480,9 @@
 }
 
 sub verify_mfa_login {
-  my $token = shift;
+  my $cgi   = Bugzilla->cgi;
+  my $token = $cgi->cookie('mfa_verification_token');
+  $cgi->remove_cookie('mfa_verification_token');
   my ($user, $event) = mfa_event_from_token($token);
   $user->authorizer->auto_verified($user, $event);
 
Index: userprefs.cgi
===================================================================
--- userprefs.cgi
+++ userprefs.cgi
@@ -177,12 +177,12 @@
 }
 
 sub MfaAccount {
-  my $cgi  = Bugzilla->cgi;
-  my $user = Bugzilla->user;
-  my $dbh  = Bugzilla->dbh;
+  my $mfa_token = shift;
+  my $user      = Bugzilla->user;
+  my $dbh       = Bugzilla->dbh;
   return unless $user->mfa;
 
-  my $event = $user->mfa_provider->verify_token($cgi->param('mfa_token'));
+  my $event = $user->mfa_provider->verify_token($mfa_token);
 
   foreach my $action (@{$event->{actions}}) {
     if ($action->{type} eq 'set_login') {
@@ -308,11 +308,11 @@
 }
 
 sub MfaSettings {
-  my $cgi  = Bugzilla->cgi;
-  my $user = Bugzilla->user;
+  my $mfa_token = shift;
+  my $user      = Bugzilla->user;
   return unless $user->mfa;
 
-  my $event = $user->mfa_provider->verify_token($cgi->param('mfa_token'));
+  my $event = $user->mfa_provider->verify_token($mfa_token);
 
   my $settings = $user->settings;
   if ($event->{reset}) {
@@ -764,14 +764,13 @@
 }
 
 sub SaveMFAcallback {
-  my $cgi  = Bugzilla->cgi;
-  my $user = Bugzilla->user;
+  my $mfa_token = shift;
+  my $user      = Bugzilla->user;
 
-  my $mfa      = $cgi->param('mfa');
-  my $provider = Bugzilla::MFA->new_from($user, $mfa) // return;
-  my $event    = $provider->verify_token($cgi->param('mfa_token'));
+  my $provider = Bugzilla::MFA->new_from($user, $mfa_token) // return;
+  my $event    = $provider->verify_token($mfa_token);
 
-  SaveMFAupdate($event->{action}, $mfa);
+  SaveMFAupdate($event->{action}, $mfa_token);
 }
 
 sub DoMFA {
@@ -932,12 +931,12 @@
 }
 
 sub MfaApiKey {
-  my $cgi  = Bugzilla->cgi;
-  my $user = Bugzilla->user;
-  my $dbh  = Bugzilla->dbh;
+  my $mfa_token = shift;
+  my $user      = Bugzilla->user;
+  my $dbh       = Bugzilla->dbh;
   return unless $user->mfa;
 
-  my $event = $user->mfa_provider->verify_token($cgi->param('mfa_token'));
+  my $event = $user->mfa_provider->verify_token($mfa_token);
 
   foreach my $action (@{$event->{actions}}) {
     if ($action->{type} eq 'create') {
@@ -999,9 +998,11 @@
 }
 Bugzilla->login(LOGIN_REQUIRED);
 
+my $mfa_token = $cgi->cookie('mfa_verification_token');
+$cgi->remove_cookie('mfa_verification_token');
+
 my $save_changes    = $cgi->param('dosave');
 my $disable_account = $cgi->param('account_disable');
-my $mfa_token       = $cgi->param('mfa_token');
 $vars->{'changes_saved'} = $save_changes || $mfa_token;
 
 my $current_tab_name = $cgi->param('tab') || "account";
@@ -1029,15 +1030,15 @@
   last SWITCH if $handled;
 
   /^account$/ && do {
-    MfaAccount()     if $mfa_token;
-    DisableAccount() if $disable_account;
-    SaveAccount()    if $save_changes;
+    MfaAccount($mfa_token) if $mfa_token;
+    DisableAccount()       if $disable_account;
+    SaveAccount()          if $save_changes;
     DoAccount();
     last SWITCH;
   };
   /^settings$/ && do {
-    MfaSettings()  if $mfa_token;
-    SaveSettings() if $save_changes;
+    MfaSettings($mfa_token) if $mfa_token;
+    SaveSettings()          if $save_changes;
     DoSettings();
     last SWITCH;
   };
@@ -1056,8 +1057,8 @@
     last SWITCH;
   };
   /^apikey$/ && do {
-    MfaApiKey()  if $mfa_token;
-    SaveApiKey() if $save_changes;
+    MfaApiKey($mfa_token) if $mfa_token;
+    SaveApiKey()          if $save_changes;
     DoApiKey();
     last SWITCH;
   };
@@ -1067,8 +1068,8 @@
     last SWITCH;
   };
   /^mfa$/ && do {
-    SaveMFAcallback() if $mfa_token;
-    SaveMFA()         if $save_changes;
+    SaveMFAcallback($mfa_token) if $mfa_token;
+    SaveMFA()                   if $save_changes;
     DoMFA();
     last SWITCH;
   };