I can't help, but when I have activated 2FA for my account, the oauth authentication flow is not working properly and a mobile app can no longer authenticate using oauth. The authentication flow ends after entering the SMS code on a "Sorry, we couldn't find that page" error page.

Instead of the usual URL REDIRECT_URI?code=xxxxxxxxxxxxxxxx

after entering the SMS code, the URL

https://m.box.com/api/oauth2/authorize?client_id=xxxxxxxxxxxxxxx&redirect_uri=REDIRECT_URI&response_type=code

is called and then causing this error. As far as I understand the oauth process, the complete handling of the authentication process until the auth code will be sent to the configured redirect URL should be done by the oauth provider.

I have no problems using the oauth flows from other providers like Google, Microsoft, Amazon etc. but box seems to work differently, so what's the deal and how could this be fixed in the mobile apps because every app I know that supports box isn't working right now with 2FA

The box app obviously uses a different authentication flow, the screens look completely different.