- Go to the test site.
- Use correct login.
- Click "Can't access your account?"
- You now have an infinite number of attempts to guess one of the recovery
codes.

I wasn't able to reproduce this is in every case but even once was not acceptable.

CommentFileSizeAuthor
#1 2339451.patch437 bytescoltrane

Comments

coltrane’s picture

coltrane
he/him
commented
StatusFileSize
new 2339451.patch437 bytes

If I check flood table in validation and error then I can prevent this use case from occurring. I've committed this but it's attached for reference.

Edit, this was committed against TFA.

coltrane’s picture

coltrane
he/him
commented
Project: TFA Basic plugins » Two-factor Authentication (TFA)
Status: Active » Fixed

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.