if the PingID service is unreachable the user will receive a QR code on an offline authentication screen. in case of Offline MFA when the network is unavailable due to a network outage (i.e. in an airplane or when network reception is poor.) or similar issue, I was wondering what are the possible risks we exposed here.
The introduction of paper "Two-Factor Authentication with End-to-End Password Security" by Stanislaw Jarecki, Hugo Krawczyk, Maliheh Shirvanian and Nitesh Saxena address all online and offline attack vectors for most MFA/TFA scenarios.
Let me quote the important section (page 2, section Vulnerabilities of traditional TFA schemes): "Existing TFA schemes, both PIN-based and those that do not rely on PINs, e.g. [1,8], combine password authentication and 2nd-factor authentication as separate authentication mechanisms leading to several limitations. Chief among these is that such TFA solutions remain vulnerable to offline dictionary attacks upon server compromise in the same way as non-TFA password authentication schemes (i.e. via exposure of users’ salted hashes), thus perpetuating the main source of password leakage.Moreover, existing TFA’s have several vulnerabilities against online attacks: (1)The read-and-copy PIN-transfer is subject to a variety of eavesdropping attacks,including SMS hijacking, shoulder-surfing, PIN recording, client-side or device-side attacks via keyloggers or screen scrapers"
In your case if the client and device are compromised (as described in this paper: "Screenmilker: how to milk your android screen for secrets"), the QR code and the user password could be known to the attacker.
I strongly recommend reading both papers I mentioned to everyone actively working with TFA/MFA solutions or scenarios.