TOTP 7.0.0 unable to activate, unable to create backupcodes, spinner never stops

Steps to reproduce

1. try to enable TOTP via UI

Expected behaviour

the QR code should be shown, the spinner should stop quickly

Actual behaviour

the spinner never stops rotating
it is impossible to create backup codes (the spinner here also goes on indefinitely)
It is impossible to log in when supposedly TOTP is active (for this specific user)

Log error:

OCA\TwoFactorTOTP\Exception\NoTotpSecretFoundException: 
/var/www/nextcloud/apps/twofactor_totp/lib/Provider/TotpProvider.php - line 105:
OCA\TwoFactorTOTP\Service\Totp->validateSecret()
/var/www/nextcloud/lib/private/Authentication/TwoFactorAuth/Manager.php - line 268:
OCA\TwoFactorTOTP\Provider\TotpProvider->verifyChallenge("*** sensiti ... *")
/var/www/nextcloud/core/Controller/TwoFactorChallengeController.php - line 182:
OC\Authentication\TwoFactorAuth\Manager->verifyChallenge("*** sensiti ... *")
/var/www/nextcloud/lib/private/AppFramework/Http/Dispatcher.php - line 225:
OC\Core\Controller\TwoFactorChallengeController->solveChallenge("*** sensiti ... *")
/var/www/nextcloud/lib/private/AppFramework/Http/Dispatcher.php - line 133:
OC\AppFramework\Http\Dispatcher->executeController()
/var/www/nextcloud/lib/private/AppFramework/App.php - line 172:
OC\AppFramework\Http\Dispatcher->dispatch()
/var/www/nextcloud/lib/private/Route/Router.php - line 298:
OC\AppFramework\App::main()
/var/www/nextcloud/lib/base.php - line 1047:
OC\Route\Router->match()
/var/www/nextcloud/index.php - line 36:
OC::handleRequest()

Server configuration

Operating system:

Web server:

Database:

PHP version:

Version: (see admin page)

Updated from an older version or fresh install:

List of activated apps:

Enabled:
  - activity: 2.17.0
  - admin_audit: 1.15.0
  - audioplayer: 3.3.1
  - bruteforcesettings: 2.5.0
  - calendar: 4.2.3
  - camerarawpreviews: 0.8.1
  - circles: 25.0.0
  - cloud_federation_api: 1.8.0
  - comments: 1.15.0
  - contacts: 5.1.0
  - dashboard: 7.5.0
  - dav: 1.24.0
  - federatedfilesharing: 1.15.0
  - federation: 1.15.0
  - files: 1.20.1
  - files_downloadactivity: 1.15.0
  - files_pdfviewer: 2.6.0
  - files_photospheres: 1.25.2
  - files_rightclick: 1.4.0
  - files_sharing: 1.17.0
  - files_trashbin: 1.15.0
  - files_versions: 1.18.0
  - firstrunwizard: 2.14.0
  - logreader: 2.10.0
  - lookup_server_connector: 1.13.0
  - maps: 0.2.4
  - metadata: 0.17.0
  - news: 20.0.1
  - nextcloud_announcements: 1.14.0
  - notes: 4.6.0
  - notifications: 2.13.1
  - notify_push: 0.5.2
  - oauth2: 1.13.0
  - password_policy: 1.15.0
  - photos: 2.0.1
  - previewgenerator: 99.99.99
  - privacy: 1.9.0
  - provisioning_api: 1.15.0
  - recommendations: 1.4.0
  - related_resources: 1.0.3
  - serverinfo: 1.15.0
  - settings: 1.7.0
  - sharebymail: 1.15.0
  - spreed: 15.0.3
  - support: 1.8.0
  - survey_client: 1.13.0
  - systemtags: 1.15.0
  - tasks: 0.14.5
  - text: 3.6.0
  - theming: 2.0.1
  - twofactor_backupcodes: 1.14.0
  - twofactor_totp: 7.0.0
  - updatenotification: 1.15.0
  - user_status: 1.5.0
  - viewer: 1.9.0
  - weather_status: 1.5.0
  - workflowengine: 2.7.0
Disabled:
  - contactsinteraction: 1.5.0
  - encryption
  - files_external
  - nextcloudpi: 0.0.1
  - suspicious_login
  - user_ldap

Start by inspecting apps/twofactor_totp/lib/Provider/TotpProvider.php around line 105 and follow the validateSecret() and verifyChallenge() calls shown in the trace. Reproduce TOTP activation and backup-code creation from the UI; done means the QR code appears, both spinners stop, and the affected user can log in with TOTP.