2

2FA is automatically bypassed after resetting password

My account have 2FA on. So usually, I log in, enter the 2FA code from an authenticator app as required. But I just discovered that if I don't want to enter it, I could:
- Click forgot password

- Enter the email address

- Go to email inbox, and click the password reset link

- Enter a new password, and enter

Now I have bypassed any authenticator app entirely!

However, I don't expect this behaviour here, nor in any other app, as enabling 2FA means I want my account to have one more layer of security.

1 reply

null
    • Gui.2
    • 2 days ago
    • Reported - view

    I'm not sure the devs care. The bug has already been reported in 2021 and nothing was done about it. It's a shame because I actually really need 2FA to work. Is there a way this can be made more visible to the devs? Maybe they missed it somehow...

Login to reply

Content aside

  • 2 Votes
  • 2 days agoLast active
  • 1Replies
  • 52Views
  • 3 Following