It seems that you can login with any password if you know the username once GA Login module is activated and given to a specific role type. There should be an option to not have to setup GA Login if the user chooses not to and another option where its mandatory.

Comments

attiks’s picture

attiks commented

Can you provide me some more details, using my contact form?

mr.baileys’s picture

mr.baileys
Primary language Dutch
Location 🇧🇪 (Ghent)
commented
Status: Active » Fixed

Fixed by SA-CONTRIB-2013-012 - Google Authenticator login - Access Bypass

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.

drumm’s picture

drumm
he/him
Location NY, US
commented
Issue summary: View changes

Please report potential security issues confidentially in the future.