@Override
    protected Event getAuthenticationFailureErrorEvent(final RequestContext context, final Exception exception) {
        if (allowedAuthenticationAttempts <= 0) {
            return super.getAuthenticationFailureErrorEvent(context, exception);
        }
        val attempts = context.getFlowScope().getLong(FLOW_SCOPE_ATTR_TOTAL_AUTHENTICATION_ATTEMPTS, 0L) + 1;
        if (attempts >= allowedAuthenticationAttempts) {
            context.getFlowScope().remove(FLOW_SCOPE_ATTR_TOTAL_AUTHENTICATION_ATTEMPTS);
            return eventFactory.event(this, CasWebflowConstants.TRANSITION_ID_CANCEL);
        }
        context.getFlowScope().put(FLOW_SCOPE_ATTR_TOTAL_AUTHENTICATION_ATTEMPTS, attempts + 1);
        return super.getAuthenticationFailureErrorEvent(context, exception);
    }
Flow scope variable to indicate count of authn attempts.
support/cas-server-support-radius-mfa/src/main/java/org/apereo/cas/adaptors/radius/web/flow/RadiusAuthenticationWebflowEventResolver.java