2

2FA is automatically bypassed after resetting password

My account have 2FA on. So usually, I log in, enter the 2FA code from an authenticator app as required. But I just discovered that if I don't want to enter it, I could:
- Click forgot password

- Enter the email address

- Go to email inbox, and click the password reset link

- Enter a new password, and enter

Now I have bypassed any authenticator app entirely!

However, I don't expect this behaviour here, nor in any other app, as enabling 2FA means I want my account to have one more layer of security.

2 replies

null
    • Gui.2
    • 3 days ago
    • Reported - view

    I'm not sure the devs care. The bug has already been reported in 2021 and nothing was done about it. It's a shame because I actually really need 2FA to work. Is there a way this can be made more visible to the devs? Maybe they missed it somehow...

      • R_P_M
      • 3 hrs ago
      • Reported - view

       There has to be a way to bypass 2FA otherwise there will be instances of being completely locked out of your account. Simply losing your device that has your 2FA codes in it will result in this situation. 

Login to reply

Content aside

  • 2 Votes
  • 3 hrs agoLast active
  • 2Replies
  • 58Views
  • 4 Following