If the user's phone's browser knows a relevant secret (a pre-shared key or the private half of a key-pair the other side has the public half saved in), then the

If the user's phone's browser knows a relevant secret (a pre-shared key or the private half of a key-pair the other side has the public half saved in), then the QR code is a magic link. Scanning the code opens the page in the browser, that page reads the secret (client-side only obviously) and uses it to sign a second request. Requires a setup step first that the magic link doesn't (getting the secret stored in the browser). Also no use if the user is trying to login with that particular device.