Whenever logging into a network device using AAA/TACACS+, if I fat-finger the password prompt after the username prompt, the second password prompt always fails even when the password is correct. I have to wait for the username prompt again, and must get the password correct on the first password prompt immediately following that. In other words, any time I see the second password prompt, it will not work.

See the sanitized interaction and config below.

User Access Verification
Username: user-name
Password:

Password:    (always fails here)
% Access denied

User Access Verification
Username: user-name
Password:

Connected to s-site-rack-agg2.example.net on line 1 (site-name).
s-site-rack-agg2#

What could be different with that second password prompt to account for this behavior?

The typical AAA and related config I have is:

aaa new-model
aaa authentication login default group tacacs+ local line
aaa authentication login CONSOLE none
aaa authentication enable default group tacacs+ enable
aaa authorization exec default group tacacs+ local if-authenticated
aaa authorization commands 1 default group tacacs+ local if-authenticated
aaa authorization commands 7 default group tacacs+ local if-authenticated
aaa authorization commands 15 default group tacacs+ local if-authenticated
aaa accounting exec default start-stop group tacacs+
aaa accounting commands 0 default start-stop group tacacs+
aaa accounting commands 1 default start-stop group tacacs+
aaa accounting commands 7 default start-stop group tacacs+
aaa accounting commands 15 default start-stop group tacacs+
aaa accounting system default start-stop group tacacs+
!
ip tacacs source-interface Loopback0
tacacs-server host -prmiaryipremoved- single-connection
tacacs-server host -secondaryipremoved- single-connection
tacacs-server timeout 10
tacacs-server directed-request
tacacs-server key 7 -removed-
!
line con 0
 login authentication CONSOLE
line vty 0 4
 location -removed-
 exec-timeout 60 0
 password 7 -removed-
 transport input telnet ssh