Catch error when server decryption fails on 2FA (#2512)

app/controllers/auth/sessions_controller.rb

@@ -51,6 +51,8 @@ class Auth::SessionsController < Devise::SessionsController
   def valid_otp_attempt?(user)
     user.validate_and_consume_otp!(user_params[:otp_attempt]) ||
       user.invalidate_otp_backup_code!(user_params[:otp_attempt])
+  rescue OpenSSL::Cipher::CipherError => error
+    false
   end
 
   def authenticate_with_two_factor