github-starred/vaultwarden
2
0
Fork 0
mirror of https://github.com/dani-garcia/vaultwarden.git synced 2026-07-20 21:25:16 -05:00
Code Issues 534 Packages Projects Releases 83 Wiki Activity

[GH-ISSUE #7096] Unable to use 2FA recovery code #11423

New Issue
Closed
opened 2026-04-20 15:02:21 -05:00 by GiteaMirror · 22 comments
GiteaMirror commented 2026-04-20 15:02:21 -05:00
Owner
Copy Link
Copy Source

Originally created by @bo0tzz on GitHub (Apr 14, 2026).
Original GitHub issue: https://github.com/dani-garcia/vaultwarden/issues/7096

Prerequisites

Vaultwarden Support String

(admin panel disabled, I can figure this out if it's needed)

Vaultwarden Build Version

docker.io/vaultwarden/server:1.35.7-alpine

Deployment method

Official Container Image

Custom deployment method

No response

Reverse Proxy

ingress-nginx 1.15.1

Host/Server Operating System

Linux

Operating System Version

Kubernetes

Clients

Android, Web Vault, Browser Extension

Client Version

web 2026.2.0

Steps To Reproduce

  1. Go to /recover-2fa page
  2. Enter inputs
  3. Hit submit
  4. Toasts:
    " Two-step login turned off on your account.
    You have been logged in! "
  5. 2FA not actually reset, not logged in

Expected Result

2FA gets reset, I'm able to log in

Actual Result

400 bad request:

{
  "MasterPasswordPolicy": {
    "Object": "masterPasswordPolicy"
  },
  "TwoFactorProviders": [
    "0"
  ],
  "TwoFactorProviders2": {
    "0": null
  },
  "error": "invalid_grant",
  "error_description": "Two factor required."
}

Logs

[2026-04-14 15:52:29.471][request][INFO] POST /identity/accounts/prelogin
[2026-04-14 15:52:29.474][response][INFO] (prelogin) POST /identity/accounts/prelogin => 200 OK
[2026-04-14 15:52:29.796][request][INFO] POST /identity/connect/token
[2026-04-14 15:52:29.943][error][ERROR] Invalid two factor provider
[2026-04-14 15:52:29.943][response][INFO] (login) POST /identity/connect/token => 400 Bad Request

Screenshots or Videos

No response

Additional Context

My clients got logged out and wanted 2FA validation again, I suspect because of the 2FA troubles in recent releases. However, I use the bitwarden android app for my vaultwarden TOTP (yes, I know). I'd always planned to use the recovery code for a situation like this, but now it's not working.

Originally created by @bo0tzz on GitHub (Apr 14, 2026). Original GitHub issue: https://github.com/dani-garcia/vaultwarden/issues/7096 ### Prerequisites - [x] I have searched the existing **Closed _AND_ Open** [Issues](https://github.com/dani-garcia/vaultwarden/issues?q=is%3Aissue%20) **_AND_** [Discussions](https://github.com/dani-garcia/vaultwarden/discussions?discussions_q=) - [x] I have searched and read the [documentation](https://github.com/dani-garcia/vaultwarden/wiki/) ### Vaultwarden Support String (admin panel disabled, I can figure this out if it's needed) ### Vaultwarden Build Version docker.io/vaultwarden/server:1.35.7-alpine ### Deployment method Official Container Image ### Custom deployment method _No response_ ### Reverse Proxy ingress-nginx 1.15.1 ### Host/Server Operating System Linux ### Operating System Version Kubernetes ### Clients Android, Web Vault, Browser Extension ### Client Version web 2026.2.0 ### Steps To Reproduce 1. Go to /recover-2fa page 2. Enter inputs 3. Hit submit 4. Toasts: " Two-step login turned off on your account. You have been logged in! " 5. 2FA not actually reset, not logged in ### Expected Result 2FA gets reset, I'm able to log in ### Actual Result 400 bad request: ```json { "MasterPasswordPolicy": { "Object": "masterPasswordPolicy" }, "TwoFactorProviders": [ "0" ], "TwoFactorProviders2": { "0": null }, "error": "invalid_grant", "error_description": "Two factor required." } ``` ### Logs ```text [2026-04-14 15:52:29.471][request][INFO] POST /identity/accounts/prelogin [2026-04-14 15:52:29.474][response][INFO] (prelogin) POST /identity/accounts/prelogin => 200 OK [2026-04-14 15:52:29.796][request][INFO] POST /identity/connect/token [2026-04-14 15:52:29.943][error][ERROR] Invalid two factor provider [2026-04-14 15:52:29.943][response][INFO] (login) POST /identity/connect/token => 400 Bad Request ``` ### Screenshots or Videos _No response_ ### Additional Context My clients got logged out and wanted 2FA validation again, I suspect because of the 2FA troubles in recent releases. However, I use the bitwarden android app for my vaultwarden TOTP (yes, I know). I'd always planned to use the recovery code for a situation like this, but now it's not working.
GiteaMirror added the bug label 2026-04-20 15:02:21 -05:00
GiteaMirror commented 2026-04-20 15:02:23 -05:00
Author
Owner
Copy Link
Copy Source

@BlackDex commented on GitHub (Apr 14, 2026):

Are you 100% sure you are running 1.35.7?
Could you provide the support string as requested?

I tested this yesterday before releasing the .7.

<!-- gh-comment-id:4245364188 --> @BlackDex commented on GitHub (Apr 14, 2026): Are you 100% sure you are running 1.35.7? Could you provide the support string as requested? I tested this yesterday before releasing the .7.
GiteaMirror commented 2026-04-20 15:02:25 -05:00
Author
Owner
Copy Link
Copy Source

@bo0tzz commented on GitHub (Apr 14, 2026):

I found a device that still has a session and put it into airplane mode just in case; however, when trying to use the TOTP code from that, I get a toast saying "invalid verification code". I suspect maybe it's got into some state where it did clear the authenticator but not fully process that?

Here's the support string:

Your environment (Generated via diagnostics page)

  • Vaultwarden version: v1.35.7
  • Web-vault version: v2026.2.0
  • OS/Arch: linux/x86_64
  • Running within a container: true (Base: Alpine)
  • Database type: PostgreSQL
  • Database version: PostgreSQL 14.18 (Debian 14.18-1.pgdg120+1) on x86_64-pc-linux-gnu, compiled by gcc (Debian 12.2.0-14) 12.2.0, 64-bit
  • Uses config.json: false
  • Uses a reverse proxy: true
  • IP Header check: true (X-Real-IP)
  • Internet access: true
  • Internet access via a proxy: false
  • DNS Check: true
  • Browser/Server Time Check: true
  • Server/NTP Time Check: true
  • Domain Configuration Check: false
  • HTTPS Check: false
  • Websocket Check: true
  • HTTP Response Checks: true

Config & Details (Generated via diagnostics page)

Show Config & Details

Config:

{
  "_duo_akey": null,
  "_enable_duo": true,
  "_enable_email_2fa": false,
  "_enable_smtp": true,
  "_enable_yubico": true,
  "_icon_service_csp": "",
  "_icon_service_url": "",
  "_ip_header_enabled": true,
  "_max_note_size": 10000,
  "_smtp_img_src": "***:",
  "admin_ratelimit_max_burst": 3,
  "admin_ratelimit_seconds": 300,
  "admin_session_lifetime": 20,
  "admin_token": "***",
  "allowed_connect_src": "",
  "allowed_iframe_ancestors": "",
  "attachments_folder": "data/attachments",
  "auth_request_purge_schedule": "30 * * * * *",
  "authenticator_disable_time_drift": false,
  "data_folder": "data",
  "database_conn_init": "",
  "database_idle_timeout": 600,
  "database_max_conns": 10,
  "database_min_conns": 2,
  "database_timeout": 30,
  "database_url": "**********://*********************************************************************",
  "db_connection_retries": 15,
  "disable_2fa_remember": false,
  "disable_admin_token": false,
  "disable_icon_download": false,
  "dns_prefer_ipv6": false,
  "domain": "****://*********",
  "domain_origin": "****://*********",
  "domain_path": "",
  "domain_set": false,
  "duo_context_purge_schedule": "30 * * * * *",
  "duo_host": null,
  "duo_ikey": null,
  "duo_skey": null,
  "duo_use_iframe": false,
  "email_2fa_auto_fallback": false,
  "email_2fa_enforce_on_verified_invite": false,
  "email_attempts_limit": 3,
  "email_change_allowed": true,
  "email_expiration_time": 600,
  "email_token_size": 6,
  "emergency_access_allowed": true,
  "emergency_notification_reminder_schedule": "0 3 * * * *",
  "emergency_request_timeout_schedule": "0 7 * * * *",
  "enable_db_wal": true,
  "enable_websocket": true,
  "enforce_single_org_with_reset_pw_policy": false,
  "event_cleanup_schedule": "0 10 0 * * *",
  "events_days_retain": null,
  "experimental_client_feature_flags": "",
  "extended_logging": true,
  "helo_name": null,
  "hibp_api_key": null,
  "http_request_block_non_global_ips": true,
  "http_request_block_regex": null,
  "icon_blacklist_non_global_ips": true,
  "icon_blacklist_regex": null,
  "icon_cache_folder": "data/icon_cache",
  "icon_cache_negttl": 259200,
  "icon_cache_ttl": 2592000,
  "icon_download_timeout": 10,
  "icon_redirect_code": 302,
  "icon_service": "internal",
  "incomplete_2fa_schedule": "30 * * * * *",
  "incomplete_2fa_time_limit": 3,
  "increase_note_size_limit": false,
  "invitation_expiration_hours": 120,
  "invitation_org_name": "Vaultwarden",
  "invitations_allowed": true,
  "ip_header": "X-Real-IP",
  "job_poll_interval_ms": 30000,
  "log_file": null,
  "log_level": "info",
  "log_timestamp_format": "%Y-%m-%d %H:%M:%S.%3f",
  "login_ratelimit_max_burst": 10,
  "login_ratelimit_seconds": 60,
  "org_attachment_limit": null,
  "org_creation_users": "",
  "org_events_enabled": false,
  "org_groups_enabled": false,
  "password_hints_allowed": true,
  "password_iterations": 600000,
  "purge_incomplete_sso_auth": "0 20 0 * * *",
  "push_enabled": false,
  "push_identity_uri": "https://identity.bitwarden.com",
  "push_installation_id": "***",
  "push_installation_key": "***",
  "push_relay_uri": "https://push.bitwarden.com",
  "reload_templates": false,
  "require_device_email": false,
  "rsa_key_filename": "data/rsa_key",
  "send_purge_schedule": "0 5 * * * *",
  "sendmail_command": null,
  "sends_allowed": true,
  "sends_folder": "data/sends",
  "show_password_hint": false,
  "signups_allowed": false,
  "signups_domains_whitelist": "",
  "signups_verify": false,
  "signups_verify_resend_limit": 6,
  "signups_verify_resend_time": 3600,
  "smtp_accept_invalid_certs": false,
  "smtp_accept_invalid_hostnames": false,
  "smtp_auth_mechanism": null,
  "smtp_debug": false,
  "smtp_embed_images": true,
  "smtp_explicit_tls": null,
  "smtp_from": "",
  "smtp_from_name": "***********",
  "smtp_host": null,
  "smtp_password": null,
  "smtp_port": 587,
  "smtp_security": "starttls",
  "smtp_ssl": null,
  "smtp_timeout": 15,
  "smtp_username": null,
  "sso_allow_unknown_email_verification": false,
  "sso_audience_trusted": null,
  "sso_auth_only_not_session": false,
  "sso_authority": "",
  "sso_authorize_extra_params": "",
  "sso_callback_path": "****://**************************************",
  "sso_client_cache_expiration": 0,
  "sso_client_id": "",
  "sso_client_secret": "***",
  "sso_debug_tokens": false,
  "sso_enabled": false,
  "sso_master_password_policy": null,
  "sso_only": false,
  "sso_pkce": true,
  "sso_scopes": "email profile",
  "sso_signups_match_email": true,
  "templates_folder": "data/templates",
  "tmp_folder": "data/tmp",
  "trash_auto_delete_days": null,
  "trash_purge_schedule": "0 5 0 * * *",
  "use_sendmail": false,
  "use_syslog": false,
  "user_attachment_limit": null,
  "user_send_limit": null,
  "web_vault_enabled": true,
  "web_vault_folder": "web-vault/",
  "yubico_client_id": null,
  "yubico_secret_key": null,
  "yubico_server": null
}
<!-- gh-comment-id:4245396231 --> @bo0tzz commented on GitHub (Apr 14, 2026): I found a device that still has a session and put it into airplane mode just in case; however, when trying to use the TOTP code from that, I get a toast saying "invalid verification code". I suspect maybe it's got into some state where it did clear the authenticator but not fully process that? Here's the support string: ### Your environment (Generated via diagnostics page) * Vaultwarden version: v1.35.7 * Web-vault version: v2026.2.0 * OS/Arch: linux/x86_64 * Running within a container: true (Base: Alpine) * Database type: PostgreSQL * Database version: PostgreSQL 14.18 (Debian 14.18-1.pgdg120+1) on x86_64-pc-linux-gnu, compiled by gcc (Debian 12.2.0-14) 12.2.0, 64-bit * Uses config.json: false * Uses a reverse proxy: true * IP Header check: true (X-Real-IP) * Internet access: true * Internet access via a proxy: false * DNS Check: true * Browser/Server Time Check: true * Server/NTP Time Check: true * Domain Configuration Check: false * HTTPS Check: false * Websocket Check: true * HTTP Response Checks: true ### Config & Details (Generated via diagnostics page) <details><summary>Show Config & Details</summary> **Config:** ```json { "_duo_akey": null, "_enable_duo": true, "_enable_email_2fa": false, "_enable_smtp": true, "_enable_yubico": true, "_icon_service_csp": "", "_icon_service_url": "", "_ip_header_enabled": true, "_max_note_size": 10000, "_smtp_img_src": "***:", "admin_ratelimit_max_burst": 3, "admin_ratelimit_seconds": 300, "admin_session_lifetime": 20, "admin_token": "***", "allowed_connect_src": "", "allowed_iframe_ancestors": "", "attachments_folder": "data/attachments", "auth_request_purge_schedule": "30 * * * * *", "authenticator_disable_time_drift": false, "data_folder": "data", "database_conn_init": "", "database_idle_timeout": 600, "database_max_conns": 10, "database_min_conns": 2, "database_timeout": 30, "database_url": "**********://*********************************************************************", "db_connection_retries": 15, "disable_2fa_remember": false, "disable_admin_token": false, "disable_icon_download": false, "dns_prefer_ipv6": false, "domain": "****://*********", "domain_origin": "****://*********", "domain_path": "", "domain_set": false, "duo_context_purge_schedule": "30 * * * * *", "duo_host": null, "duo_ikey": null, "duo_skey": null, "duo_use_iframe": false, "email_2fa_auto_fallback": false, "email_2fa_enforce_on_verified_invite": false, "email_attempts_limit": 3, "email_change_allowed": true, "email_expiration_time": 600, "email_token_size": 6, "emergency_access_allowed": true, "emergency_notification_reminder_schedule": "0 3 * * * *", "emergency_request_timeout_schedule": "0 7 * * * *", "enable_db_wal": true, "enable_websocket": true, "enforce_single_org_with_reset_pw_policy": false, "event_cleanup_schedule": "0 10 0 * * *", "events_days_retain": null, "experimental_client_feature_flags": "", "extended_logging": true, "helo_name": null, "hibp_api_key": null, "http_request_block_non_global_ips": true, "http_request_block_regex": null, "icon_blacklist_non_global_ips": true, "icon_blacklist_regex": null, "icon_cache_folder": "data/icon_cache", "icon_cache_negttl": 259200, "icon_cache_ttl": 2592000, "icon_download_timeout": 10, "icon_redirect_code": 302, "icon_service": "internal", "incomplete_2fa_schedule": "30 * * * * *", "incomplete_2fa_time_limit": 3, "increase_note_size_limit": false, "invitation_expiration_hours": 120, "invitation_org_name": "Vaultwarden", "invitations_allowed": true, "ip_header": "X-Real-IP", "job_poll_interval_ms": 30000, "log_file": null, "log_level": "info", "log_timestamp_format": "%Y-%m-%d %H:%M:%S.%3f", "login_ratelimit_max_burst": 10, "login_ratelimit_seconds": 60, "org_attachment_limit": null, "org_creation_users": "", "org_events_enabled": false, "org_groups_enabled": false, "password_hints_allowed": true, "password_iterations": 600000, "purge_incomplete_sso_auth": "0 20 0 * * *", "push_enabled": false, "push_identity_uri": "https://identity.bitwarden.com", "push_installation_id": "***", "push_installation_key": "***", "push_relay_uri": "https://push.bitwarden.com", "reload_templates": false, "require_device_email": false, "rsa_key_filename": "data/rsa_key", "send_purge_schedule": "0 5 * * * *", "sendmail_command": null, "sends_allowed": true, "sends_folder": "data/sends", "show_password_hint": false, "signups_allowed": false, "signups_domains_whitelist": "", "signups_verify": false, "signups_verify_resend_limit": 6, "signups_verify_resend_time": 3600, "smtp_accept_invalid_certs": false, "smtp_accept_invalid_hostnames": false, "smtp_auth_mechanism": null, "smtp_debug": false, "smtp_embed_images": true, "smtp_explicit_tls": null, "smtp_from": "", "smtp_from_name": "***********", "smtp_host": null, "smtp_password": null, "smtp_port": 587, "smtp_security": "starttls", "smtp_ssl": null, "smtp_timeout": 15, "smtp_username": null, "sso_allow_unknown_email_verification": false, "sso_audience_trusted": null, "sso_auth_only_not_session": false, "sso_authority": "", "sso_authorize_extra_params": "", "sso_callback_path": "****://**************************************", "sso_client_cache_expiration": 0, "sso_client_id": "", "sso_client_secret": "***", "sso_debug_tokens": false, "sso_enabled": false, "sso_master_password_policy": null, "sso_only": false, "sso_pkce": true, "sso_scopes": "email profile", "sso_signups_match_email": true, "templates_folder": "data/templates", "tmp_folder": "data/tmp", "trash_auto_delete_days": null, "trash_purge_schedule": "0 5 0 * * *", "use_sendmail": false, "use_syslog": false, "user_attachment_limit": null, "user_send_limit": null, "web_vault_enabled": true, "web_vault_folder": "web-vault/", "yubico_client_id": null, "yubico_secret_key": null, "yubico_server": null } ``` </details>
GiteaMirror commented 2026-04-20 15:02:26 -05:00
Author
Owner
Copy Link
Copy Source

@bo0tzz commented on GitHub (Apr 14, 2026):

I just found that 2FA can be disabled from the admin panel, so I did that and that worked fine; I can log in properly now. I realised slightly too late that that may have destroyed some state that'd be useful for troubleshooting/bug-hunting, sorry.

<!-- gh-comment-id:4245413677 --> @bo0tzz commented on GitHub (Apr 14, 2026): I just found that 2FA can be disabled from the admin panel, so I did that and that worked fine; I can log in properly now. I realised slightly too late that that may have destroyed some state that'd be useful for troubleshooting/bug-hunting, sorry.
GiteaMirror commented 2026-04-20 15:02:27 -05:00
Author
Owner
Copy Link
Copy Source

@BlackDex commented on GitHub (Apr 14, 2026):

If you can provide which 2FA's you had enabled we might be able to reproduce, but again, i tested it yesterday and it removed my configured 2FA's.

<!-- gh-comment-id:4245426810 --> @BlackDex commented on GitHub (Apr 14, 2026): If you can provide which 2FA's you had enabled we might be able to reproduce, but again, i tested it yesterday and it removed my configured 2FA's.
GiteaMirror commented 2026-04-20 15:02:27 -05:00
Author
Owner
Copy Link
Copy Source

@bo0tzz commented on GitHub (Apr 14, 2026):

I was using just TOTP/authenticator app.

<!-- gh-comment-id:4245495446 --> @bo0tzz commented on GitHub (Apr 14, 2026): I was using just TOTP/authenticator app.
GiteaMirror commented 2026-04-20 15:02:29 -05:00
Author
Owner
Copy Link
Copy Source

@BlackDex commented on GitHub (Apr 14, 2026):

I tested that, and email and webauthn.

<!-- gh-comment-id:4245993975 --> @BlackDex commented on GitHub (Apr 14, 2026): I tested that, and email and webauthn.
GiteaMirror commented 2026-04-20 15:02:30 -05:00
Author
Owner
Copy Link
Copy Source

@fblz commented on GitHub (Apr 14, 2026):

I am having the exact same issue with TOTP right now.
However I did not yet clear the 2FA from the admin panel.

Your environment (Generated via diagnostics page)

  • Vaultwarden version: v1.35.7
  • Web-vault version: v2026.2.0
  • OS/Arch: linux/x86_64
  • Running within a container: false (Base: Not applicable)
  • Database type: SQLite
  • Database version: 3.53.0
  • Uses config.json: false
  • Uses a reverse proxy: false
  • Internet access: true
  • Internet access via a proxy: false
  • DNS Check: true
  • Browser/Server Time Check: true
  • Server/NTP Time Check: true
  • Domain Configuration Check: false
  • HTTPS Check: true
  • Websocket Check: true
  • HTTP Response Checks: true

Config & Details (Generated via diagnostics page)

Show Config & Details

Config:

{
  "_duo_akey": null,
  "_enable_duo": false,
  "_enable_email_2fa": false,
  "_enable_smtp": true,
  "_enable_yubico": false,
  "_icon_service_csp": "",
  "_icon_service_url": "",
  "_ip_header_enabled": true,
  "_max_note_size": 10000,
  "_smtp_img_src": "***:",
  "admin_ratelimit_max_burst": 3,
  "admin_ratelimit_seconds": 300,
  "admin_session_lifetime": 20,
  "admin_token": "***",
  "allowed_connect_src": "",
  "allowed_iframe_ancestors": "",
  "attachments_folder": "/opt/vaultwarden/data/attachments",
  "auth_request_purge_schedule": "30 * * * * *",
  "authenticator_disable_time_drift": false,
  "data_folder": "/opt/vaultwarden/data",
  "database_conn_init": "",
  "database_idle_timeout": 600,
  "database_max_conns": 10,
  "database_min_conns": 2,
  "database_timeout": 30,
  "database_url": "********************************",
  "db_connection_retries": 15,
  "disable_2fa_remember": false,
  "disable_admin_token": false,
  "disable_icon_download": false,
  "dns_prefer_ipv6": false,
  "domain": "*****://*************",
  "domain_origin": "*****://*************",
  "domain_path": "",
  "domain_set": true,
  "duo_context_purge_schedule": "30 * * * * *",
  "duo_host": null,
  "duo_ikey": null,
  "duo_skey": null,
  "duo_use_iframe": false,
  "email_2fa_auto_fallback": false,
  "email_2fa_enforce_on_verified_invite": false,
  "email_attempts_limit": 3,
  "email_change_allowed": true,
  "email_expiration_time": 600,
  "email_token_size": 6,
  "emergency_access_allowed": true,
  "emergency_notification_reminder_schedule": "0 3 * * * *",
  "emergency_request_timeout_schedule": "0 7 * * * *",
  "enable_db_wal": true,
  "enable_websocket": true,
  "enforce_single_org_with_reset_pw_policy": false,
  "event_cleanup_schedule": "0 10 0 * * *",
  "events_days_retain": null,
  "experimental_client_feature_flags": "",
  "extended_logging": true,
  "helo_name": null,
  "hibp_api_key": null,
  "http_request_block_non_global_ips": true,
  "http_request_block_regex": null,
  "icon_blacklist_non_global_ips": true,
  "icon_blacklist_regex": null,
  "icon_cache_folder": "/opt/vaultwarden/data/icon_cache",
  "icon_cache_negttl": 259200,
  "icon_cache_ttl": 2592000,
  "icon_download_timeout": 10,
  "icon_redirect_code": 302,
  "icon_service": "internal",
  "incomplete_2fa_schedule": "30 * * * * *",
  "incomplete_2fa_time_limit": 3,
  "increase_note_size_limit": false,
  "invitation_expiration_hours": 120,
  "invitation_org_name": "Vaultwarden",
  "invitations_allowed": true,
  "ip_header": "X-Real-IP",
  "job_poll_interval_ms": 30000,
  "log_file": null,
  "log_level": "warn",
  "log_timestamp_format": "%Y-%m-%d %H:%M:%S.%3f",
  "login_ratelimit_max_burst": 10,
  "login_ratelimit_seconds": 60,
  "org_attachment_limit": null,
  "org_creation_users": "************",
  "org_events_enabled": false,
  "org_groups_enabled": false,
  "password_hints_allowed": true,
  "password_iterations": 100000,
  "purge_incomplete_sso_auth": "0 20 0 * * *",
  "push_enabled": true,
  "push_identity_uri": "https://identity.bitwarden.eu",
  "push_installation_id": "***",
  "push_installation_key": "***",
  "push_relay_uri": "https://api.bitwarden.eu",
  "reload_templates": false,
  "require_device_email": false,
  "rsa_key_filename": "/opt/vaultwarden/data/rsa_key",
  "send_purge_schedule": "0 5 * * * *",
  "sendmail_command": null,
  "sends_allowed": true,
  "sends_folder": "/opt/vaultwarden/data/sends",
  "show_password_hint": false,
  "signups_allowed": false,
  "signups_domains_whitelist": "",
  "signups_verify": false,
  "signups_verify_resend_limit": 6,
  "signups_verify_resend_time": 3600,
  "smtp_accept_invalid_certs": false,
  "smtp_accept_invalid_hostnames": false,
  "smtp_auth_mechanism": "Plain",
  "smtp_debug": false,
  "smtp_embed_images": true,
  "smtp_explicit_tls": null,
  "smtp_from": "***************",
  "smtp_from_name": "***********",
  "smtp_host": "*************",
  "smtp_password": "***",
  "smtp_port": 465,
  "smtp_security": "force_tls",
  "smtp_ssl": null,
  "smtp_timeout": 15,
  "smtp_username": "***********",
  "sso_allow_unknown_email_verification": false,
  "sso_audience_trusted": null,
  "sso_auth_only_not_session": false,
  "sso_authority": "",
  "sso_authorize_extra_params": "",
  "sso_callback_path": "*****://******************************************",
  "sso_client_cache_expiration": 0,
  "sso_client_id": "",
  "sso_client_secret": "***",
  "sso_debug_tokens": false,
  "sso_enabled": false,
  "sso_master_password_policy": null,
  "sso_only": false,
  "sso_pkce": true,
  "sso_scopes": "email profile",
  "sso_signups_match_email": true,
  "templates_folder": "/opt/vaultwarden/data/templates",
  "tmp_folder": "/opt/vaultwarden/data/tmp",
  "trash_auto_delete_days": null,
  "trash_purge_schedule": "0 5 0 * * *",
  "use_sendmail": false,
  "use_syslog": false,
  "user_attachment_limit": null,
  "user_send_limit": null,
  "web_vault_enabled": true,
  "web_vault_folder": "/opt/vaultwarden/web-vault/",
  "yubico_client_id": null,
  "yubico_secret_key": null,
  "yubico_server": null
}
<!-- gh-comment-id:4247617896 --> @fblz commented on GitHub (Apr 14, 2026): I am having the exact same issue with TOTP right now. However I did not yet clear the 2FA from the admin panel. ### Your environment (Generated via diagnostics page) * Vaultwarden version: v1.35.7 * Web-vault version: v2026.2.0 * OS/Arch: linux/x86_64 * Running within a container: false (Base: Not applicable) * Database type: SQLite * Database version: 3.53.0 * Uses config.json: false * Uses a reverse proxy: false * Internet access: true * Internet access via a proxy: false * DNS Check: true * Browser/Server Time Check: true * Server/NTP Time Check: true * Domain Configuration Check: false * HTTPS Check: true * Websocket Check: true * HTTP Response Checks: true ### Config & Details (Generated via diagnostics page) <details><summary>Show Config & Details</summary> **Config:** ```json { "_duo_akey": null, "_enable_duo": false, "_enable_email_2fa": false, "_enable_smtp": true, "_enable_yubico": false, "_icon_service_csp": "", "_icon_service_url": "", "_ip_header_enabled": true, "_max_note_size": 10000, "_smtp_img_src": "***:", "admin_ratelimit_max_burst": 3, "admin_ratelimit_seconds": 300, "admin_session_lifetime": 20, "admin_token": "***", "allowed_connect_src": "", "allowed_iframe_ancestors": "", "attachments_folder": "/opt/vaultwarden/data/attachments", "auth_request_purge_schedule": "30 * * * * *", "authenticator_disable_time_drift": false, "data_folder": "/opt/vaultwarden/data", "database_conn_init": "", "database_idle_timeout": 600, "database_max_conns": 10, "database_min_conns": 2, "database_timeout": 30, "database_url": "********************************", "db_connection_retries": 15, "disable_2fa_remember": false, "disable_admin_token": false, "disable_icon_download": false, "dns_prefer_ipv6": false, "domain": "*****://*************", "domain_origin": "*****://*************", "domain_path": "", "domain_set": true, "duo_context_purge_schedule": "30 * * * * *", "duo_host": null, "duo_ikey": null, "duo_skey": null, "duo_use_iframe": false, "email_2fa_auto_fallback": false, "email_2fa_enforce_on_verified_invite": false, "email_attempts_limit": 3, "email_change_allowed": true, "email_expiration_time": 600, "email_token_size": 6, "emergency_access_allowed": true, "emergency_notification_reminder_schedule": "0 3 * * * *", "emergency_request_timeout_schedule": "0 7 * * * *", "enable_db_wal": true, "enable_websocket": true, "enforce_single_org_with_reset_pw_policy": false, "event_cleanup_schedule": "0 10 0 * * *", "events_days_retain": null, "experimental_client_feature_flags": "", "extended_logging": true, "helo_name": null, "hibp_api_key": null, "http_request_block_non_global_ips": true, "http_request_block_regex": null, "icon_blacklist_non_global_ips": true, "icon_blacklist_regex": null, "icon_cache_folder": "/opt/vaultwarden/data/icon_cache", "icon_cache_negttl": 259200, "icon_cache_ttl": 2592000, "icon_download_timeout": 10, "icon_redirect_code": 302, "icon_service": "internal", "incomplete_2fa_schedule": "30 * * * * *", "incomplete_2fa_time_limit": 3, "increase_note_size_limit": false, "invitation_expiration_hours": 120, "invitation_org_name": "Vaultwarden", "invitations_allowed": true, "ip_header": "X-Real-IP", "job_poll_interval_ms": 30000, "log_file": null, "log_level": "warn", "log_timestamp_format": "%Y-%m-%d %H:%M:%S.%3f", "login_ratelimit_max_burst": 10, "login_ratelimit_seconds": 60, "org_attachment_limit": null, "org_creation_users": "************", "org_events_enabled": false, "org_groups_enabled": false, "password_hints_allowed": true, "password_iterations": 100000, "purge_incomplete_sso_auth": "0 20 0 * * *", "push_enabled": true, "push_identity_uri": "https://identity.bitwarden.eu", "push_installation_id": "***", "push_installation_key": "***", "push_relay_uri": "https://api.bitwarden.eu", "reload_templates": false, "require_device_email": false, "rsa_key_filename": "/opt/vaultwarden/data/rsa_key", "send_purge_schedule": "0 5 * * * *", "sendmail_command": null, "sends_allowed": true, "sends_folder": "/opt/vaultwarden/data/sends", "show_password_hint": false, "signups_allowed": false, "signups_domains_whitelist": "", "signups_verify": false, "signups_verify_resend_limit": 6, "signups_verify_resend_time": 3600, "smtp_accept_invalid_certs": false, "smtp_accept_invalid_hostnames": false, "smtp_auth_mechanism": "Plain", "smtp_debug": false, "smtp_embed_images": true, "smtp_explicit_tls": null, "smtp_from": "***************", "smtp_from_name": "***********", "smtp_host": "*************", "smtp_password": "***", "smtp_port": 465, "smtp_security": "force_tls", "smtp_ssl": null, "smtp_timeout": 15, "smtp_username": "***********", "sso_allow_unknown_email_verification": false, "sso_audience_trusted": null, "sso_auth_only_not_session": false, "sso_authority": "", "sso_authorize_extra_params": "", "sso_callback_path": "*****://******************************************", "sso_client_cache_expiration": 0, "sso_client_id": "", "sso_client_secret": "***", "sso_debug_tokens": false, "sso_enabled": false, "sso_master_password_policy": null, "sso_only": false, "sso_pkce": true, "sso_scopes": "email profile", "sso_signups_match_email": true, "templates_folder": "/opt/vaultwarden/data/templates", "tmp_folder": "/opt/vaultwarden/data/tmp", "trash_auto_delete_days": null, "trash_purge_schedule": "0 5 0 * * *", "use_sendmail": false, "use_syslog": false, "user_attachment_limit": null, "user_send_limit": null, "web_vault_enabled": true, "web_vault_folder": "/opt/vaultwarden/web-vault/", "yubico_client_id": null, "yubico_secret_key": null, "yubico_server": null } ``` </details>
GiteaMirror commented 2026-04-20 15:02:31 -05:00
Author
Owner
Copy Link
Copy Source

@BlackDex commented on GitHub (Apr 14, 2026):

@fblz So, your recovery token didn't cleared all 2FA's?
And are you able to use that token twice or more, even after the first try?

What do the logs report?

<!-- gh-comment-id:4247653628 --> @BlackDex commented on GitHub (Apr 14, 2026): @fblz So, your recovery token didn't cleared all 2FA's? And are you able to use that token twice or more, even after the first try? What do the logs report?
GiteaMirror commented 2026-04-20 15:02:32 -05:00
Author
Owner
Copy Link
Copy Source

@fblz commented on GitHub (Apr 14, 2026):

I can enter the token multiple times on /#/recover-2fa.
The following line is logged when I try:

Apr 15 00:44:44 vaultwarden[47849]: [2026-04-15 00:44:44.240][error][ERROR] Invalid two factor provider

I'll have a look at increasing log level.

<!-- gh-comment-id:4247681745 --> @fblz commented on GitHub (Apr 14, 2026): I can enter the token multiple times on `/#/recover-2fa`. The following line is logged when I try: ``` Apr 15 00:44:44 vaultwarden[47849]: [2026-04-15 00:44:44.240][error][ERROR] Invalid two factor provider ``` I'll have a look at increasing log level.
GiteaMirror commented 2026-04-20 15:02:33 -05:00
Author
Owner
Copy Link
Copy Source

@fblz commented on GitHub (Apr 14, 2026):

@BlackDex with log level debug:

Apr 15 00:50:30 vaultwarden[166448]: [2026-04-15 00:50:30.089][vaultwarden::api::core::two_factor][DEBUG] Sending notifications for incomplete 2FA logins
Apr 15 00:50:30 vaultwarden[166448]: [2026-04-15 00:50:30.089][vaultwarden::api::core::accounts][DEBUG] Purging auth requests
Apr 15 00:51:30 vaultwarden[166448]: [2026-04-15 00:51:30.091][vaultwarden::api::core::accounts][DEBUG] Purging auth requests
Apr 15 00:51:30 vaultwarden[166448]: [2026-04-15 00:51:30.091][vaultwarden::api::core::two_factor][DEBUG] Sending notifications for incomplete 2FA logins
Apr 15 00:51:51 vaultwarden[166448]: [2026-04-15 00:51:51.274][request][INFO] GET /api/config
Apr 15 00:51:51 vaultwarden[166448]: [2026-04-15 00:51:51.275][response][INFO] (config) GET /api/config => 200 OK
Apr 15 00:52:02 vaultwarden[166448]: [2026-04-15 00:52:02.522][request][INFO] POST /identity/accounts/prelogin
Apr 15 00:52:02 vaultwarden[166448]: [2026-04-15 00:52:02.523][response][INFO] (prelogin) POST /identity/accounts/prelogin => 200 OK
Apr 15 00:52:03 vaultwarden[166448]: [2026-04-15 00:52:03.004][request][INFO] POST /identity/connect/token
Apr 15 00:52:03 vaultwarden[166448]: [2026-04-15 00:52:03.081][error][ERROR] Invalid two factor provider
Apr 15 00:52:03 vaultwarden[166448]: [2026-04-15 00:52:03.081][response][INFO] (login) POST /identity/connect/token => 400 Bad Request

Response for the post to /identity/connect/token:

{"MasterPasswordPolicy":{"Object":"masterPasswordPolicy"},"TwoFactorProviders":["0"],"TwoFactorProviders2":{"0":null},"error":"invalid_grant","error_description":"Two factor required."}
<!-- gh-comment-id:4247741487 --> @fblz commented on GitHub (Apr 14, 2026): @BlackDex with log level debug: ``` Apr 15 00:50:30 vaultwarden[166448]: [2026-04-15 00:50:30.089][vaultwarden::api::core::two_factor][DEBUG] Sending notifications for incomplete 2FA logins Apr 15 00:50:30 vaultwarden[166448]: [2026-04-15 00:50:30.089][vaultwarden::api::core::accounts][DEBUG] Purging auth requests Apr 15 00:51:30 vaultwarden[166448]: [2026-04-15 00:51:30.091][vaultwarden::api::core::accounts][DEBUG] Purging auth requests Apr 15 00:51:30 vaultwarden[166448]: [2026-04-15 00:51:30.091][vaultwarden::api::core::two_factor][DEBUG] Sending notifications for incomplete 2FA logins Apr 15 00:51:51 vaultwarden[166448]: [2026-04-15 00:51:51.274][request][INFO] GET /api/config Apr 15 00:51:51 vaultwarden[166448]: [2026-04-15 00:51:51.275][response][INFO] (config) GET /api/config => 200 OK Apr 15 00:52:02 vaultwarden[166448]: [2026-04-15 00:52:02.522][request][INFO] POST /identity/accounts/prelogin Apr 15 00:52:02 vaultwarden[166448]: [2026-04-15 00:52:02.523][response][INFO] (prelogin) POST /identity/accounts/prelogin => 200 OK Apr 15 00:52:03 vaultwarden[166448]: [2026-04-15 00:52:03.004][request][INFO] POST /identity/connect/token Apr 15 00:52:03 vaultwarden[166448]: [2026-04-15 00:52:03.081][error][ERROR] Invalid two factor provider Apr 15 00:52:03 vaultwarden[166448]: [2026-04-15 00:52:03.081][response][INFO] (login) POST /identity/connect/token => 400 Bad Request ``` Response for the post to `/identity/connect/token`: ``` {"MasterPasswordPolicy":{"Object":"masterPasswordPolicy"},"TwoFactorProviders":["0"],"TwoFactorProviders2":{"0":null},"error":"invalid_grant","error_description":"Two factor required."} ```
GiteaMirror commented 2026-04-20 15:02:36 -05:00
Author
Owner
Copy Link
Copy Source

@fblz commented on GitHub (Apr 15, 2026):

I can keep the situation as is for the next ~10h. After that I need to reset the 2FA from the admin panel. If you want to test something on my side, let me know.

<!-- gh-comment-id:4248404829 --> @fblz commented on GitHub (Apr 15, 2026): I can keep the situation as is for the next ~10h. After that I need to reset the 2FA from the admin panel. If you want to test something on my side, let me know.
GiteaMirror commented 2026-04-20 15:02:37 -05:00
Author
Owner
Copy Link
Copy Source

@BlackDex commented on GitHub (Apr 15, 2026):

I would need to have the logs during the attempt to use the 2fa-recovery.
If possible with debug log level to get a bit more details maybe.

Because, does it report that the recovery code is invalid, or does it report it is valid, but then does not remove all 2FA's?

<!-- gh-comment-id:4250065789 --> @BlackDex commented on GitHub (Apr 15, 2026): I would need to have the logs during the attempt to use the 2fa-recovery. If possible with debug log level to get a bit more details maybe. Because, does it report that the recovery code is invalid, or does it report it is valid, but then does not remove all 2FA's?
GiteaMirror commented 2026-04-20 15:02:38 -05:00
Author
Owner
Copy Link
Copy Source

@stefan0xC commented on GitHub (Apr 15, 2026):

It fails before because the selected id (8) is not in the list of twofactor_ids https://github.com/dani-garcia/vaultwarden/blob/e7e4b9a86d4effaadd67e3465d36100d47d0f073/src/api/identity.rs#L764-L769

<!-- gh-comment-id:4250096121 --> @stefan0xC commented on GitHub (Apr 15, 2026): It fails before because the selected id (8) is not in the list of twofactor_ids https://github.com/dani-garcia/vaultwarden/blob/e7e4b9a86d4effaadd67e3465d36100d47d0f073/src/api/identity.rs#L764-L769
GiteaMirror commented 2026-04-20 15:02:38 -05:00
Author
Owner
Copy Link
Copy Source

@BlackDex commented on GitHub (Apr 15, 2026):

But, how did it worked for me than after this change?
Very strange.

But, we can't add it either, that will break Android.

<!-- gh-comment-id:4250193195 --> @BlackDex commented on GitHub (Apr 15, 2026): But, how did it worked for me than after this change? Very strange. But, we can't add it either, that will break Android.
GiteaMirror commented 2026-04-20 15:02:39 -05:00
Author
Owner
Copy Link
Copy Source

@stefan0xC commented on GitHub (Apr 15, 2026):

But, we can't add it either, that will break Android.

We could make an exception for the check if it is the Recover Code? Or does this break too?

<!-- gh-comment-id:4250303197 --> @stefan0xC commented on GitHub (Apr 15, 2026): > But, we can't add it either, that will break Android. We could make an exception for the check if it is the Recover Code? Or does this break too?
GiteaMirror commented 2026-04-20 15:02:40 -05:00
Author
Owner
Copy Link
Copy Source

@BlackDex commented on GitHub (Apr 15, 2026):

That PR to filter those items made it too complex hehe.
Apparently there were more items depending on these checks/values.

<!-- gh-comment-id:4250534726 --> @BlackDex commented on GitHub (Apr 15, 2026): That PR to filter those items made it too complex hehe. Apparently there were more items depending on these checks/values.
GiteaMirror commented 2026-04-20 15:02:42 -05:00
Author
Owner
Copy Link
Copy Source

@fblz commented on GitHub (Apr 15, 2026):

I would need to have the logs during the attempt to use the 2fa-recovery. If possible with debug log level to get a bit more details maybe.

What I posted above are said logs with log level debug 🤔
I am fine with trying a special debug build, if that helps.

<!-- gh-comment-id:4250569642 --> @fblz commented on GitHub (Apr 15, 2026): > I would need to have the logs during the attempt to use the 2fa-recovery. If possible with debug log level to get a bit more details maybe. What I posted above are said logs with log level debug 🤔 I am fine with trying a special debug build, if that helps.
GiteaMirror commented 2026-04-20 15:02:44 -05:00
Author
Owner
Copy Link
Copy Source

@BlackDex commented on GitHub (Apr 15, 2026):

@fblz no need for special builds, all can be configured already. Just set LOG_LEVEL=debug as env

<!-- gh-comment-id:4250983942 --> @BlackDex commented on GitHub (Apr 15, 2026): @fblz no need for special builds, all can be configured already. Just set `LOG_LEVEL=debug` as env
GiteaMirror commented 2026-04-20 15:02:44 -05:00
Author
Owner
Copy Link
Copy Source

@fblz commented on GitHub (Apr 15, 2026):

@BlackDex already did.
--> https://github.com/dani-garcia/vaultwarden/issues/7096#issuecomment-4247741487
This is all log output beginning after loading the /#/recover-2fa site (i.e. HTML loaded but nothing entered into the forms), until after the two in-browser toasts saying Two-step login turned off on your account., You have been logged in!.

<!-- gh-comment-id:4251112821 --> @fblz commented on GitHub (Apr 15, 2026): @BlackDex already did. --> https://github.com/dani-garcia/vaultwarden/issues/7096#issuecomment-4247741487 This is all log output beginning after loading the `/#/recover-2fa` site (i.e. HTML loaded but nothing entered into the forms), until after the two in-browser toasts saying `Two-step login turned off on your account.`, `You have been logged in!`.
GiteaMirror commented 2026-04-20 15:02:45 -05:00
Author
Owner
Copy Link
Copy Source

@BlackDex commented on GitHub (Apr 15, 2026):

I have it fixed now.. for real this time.

<!-- gh-comment-id:4253644360 --> @BlackDex commented on GitHub (Apr 15, 2026): I have it fixed now.. **for real** this time.
GiteaMirror commented 2026-04-20 15:02:46 -05:00
Author
Owner
Copy Link
Copy Source

@BlackDex commented on GitHub (Apr 15, 2026):

Before we release a new version, would someone be so kind to test and verify the :testing tagged container image?

<!-- gh-comment-id:4255080564 --> @BlackDex commented on GitHub (Apr 15, 2026): Before we release a new version, would someone be so kind to test and verify the `:testing` tagged container image?
GiteaMirror commented 2026-04-20 15:02:48 -05:00
Author
Owner
Copy Link
Copy Source

@FSaurenbach commented on GitHub (Apr 16, 2026):

Before we release a new version, would someone be so kind to test and verify the :testing tagged container image?

I used testing-alpine and it worked fine, to rule out any errors I tried with the latest image before that and it did indeed fail.
I had totp only enabled
Thanks for fixing!

<!-- gh-comment-id:4260511298 --> @FSaurenbach commented on GitHub (Apr 16, 2026): > Before we release a new version, would someone be so kind to test and verify the `:testing` tagged container image? I used testing-alpine and it worked fine, to rule out any errors I tried with the latest image before that and it did indeed fail. I had totp only enabled Thanks for fixing!
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
better for forum
bug
documentation
duplicate
enhancement
future Vault
good first issue
help wanted
low priority
notes
pull-request
Mirrored from GitHub Pull Request
 question
SSO
Third party
troubleshooting
wontfix
No labels bug
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
GiteaMirror ninjasurge (Kaehlen Rog)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/vaultwarden#11423