The issue is indeed fixed in 3.0.2. Thanks for solving this on a short notice!
For the future it would be very helpful if I could rollback to the previous version while waiting for a fix. This would prevent me from having to turn off 2fas on our client website altogether.
Is there a reason that only “dev-trunk” and the latest version are available on wpackagist?