TrustTokenRequired on change-password when MFA not enabled

[stephen.saucier 0]

Using the change-password endpoint with a changePasswordId included from a login request (the user is marked as having to change his password on next login), we're getting a TrustTokenRequired response instead of a 200 success:

{"generalErrors": [{"code": "[TrustTokenRequired]", "message": "This request requires a Trust Token. Use the Start Two-Factor API to obtain a Trust Token required to complete this request."}]}

Multi-factor is not enabled for this user, so this response doesn't seem to make sense.

Am I missing a setting somewhere or something else, or is this a bug?

[stephen.saucier 0]

When I changed the user's password manually in FA (change on next login was still enabled), it then allowed the password to be changed properly via the API without any Trust Token.