diff --git a/docs/07-users/02-multi-factor-authentication.md b/docs/07-users/02-multi-factor-authentication.md
index cfd8ab7a17..3ebc95ca78 100644
--- a/docs/07-users/02-multi-factor-authentication.md
+++ b/docs/07-users/02-multi-factor-authentication.md
@@ -82,6 +82,10 @@ public function panel(Panel $panel): Panel
 }
 ```
 
+<Aside variant="warning">
+    To prevent the same app authentication code from being accepted more than once, use a default cache store that supports atomic locks, such as the database or Redis cache driver. All application servers must use the same cache backend. With other cache configurations, concurrent requests may accept the same code more than once.
+</Aside>
+
 ### Setting up app recovery codes
 
 If your users lose access to their two-factor authentication app, they will be unable to sign in to your application. To prevent this, you can generate a set of recovery codes that users can use to sign in if they lose access to their two-factor authentication app.