Steps to reproduce:

1. Create a user pool

awslocal cognito-idp create-user-pool
--pool-name "TestPortalPool"
--schema Name="userRole",AttributeDataType="String"
--username-attributes email
--auto-verified-attributes email
--region "${AWS_REGION}"

2. Create a user

USER_EMAIL=test@email.com
USER_PASSWORD=Qwerty123!

awslocal cognito-idp admin-create-user
--user-pool-id "${USER_POOL_ID}"
--username "${USER_EMAIL}"
--temporary-password "${USER_PASSWORD}"
--user-attributes Name="custom:userRole",Value="SUPER"
--region "${AWS_REGION}"

3. Get the token
4. Send the NEW_PASSWORD_REQUIRED challenge
5. Send the NEW_PASSWORD_REQUIRED challenge second time and get response status code 200

The status code for a repeated NEW_PASSWORD_REQUIRED challenge request should be 401.