A vulnerability hole on android firefox sync

Security
#1

I logged in on Firefox android app. It asked for code sent to email, I DID NOT enter it. But later when I came back to app it was logged in and had synced data.
Version: 97.3.0

#2

Update: Now that I reboot phone it is logged out from firefox sync and wiped synced passwords from device. Definitely a bug

#3

which not any kind of the vulnerability, hole on the android firefox sync i am personally tested.