github-starred/vaultwarden
2
0
Fork 0
mirror of https://github.com/dani-garcia/vaultwarden.git synced 2026-07-17 09:22:30 -05:00
Code Issues 481 Packages Projects Releases 83 Wiki Activity

[GH-ISSUE #6203] 2FA Recovery Code no longer working #29860

New Issue
Closed
opened 2026-06-17 09:31:49 -05:00 by GiteaMirror · 4 comments
GiteaMirror commented 2026-06-17 09:31:49 -05:00
Owner
Copy Link

Originally created by @shadow1runner on GitHub (Aug 20, 2025).
Original GitHub issue: https://github.com/dani-garcia/vaultwarden/issues/6203

Originally assigned to: @BlackDex on GitHub.

I've enabled two 2FA mechanisms: mail and authenticator app.
Following the upstream docs, I'm trying to recover using the recovery code which I've just copied from https://mydomain.example.localhost/#/settings/security/two-factor (alongside the user name and master password, of course).

I do not get an error in the web UI, but I'm just redirected to the main login view; the network pane reads as follows:

image

The log shows a single line:

vaultwarden-5d964b5d76-zqmsr [2025-08-19 22:49:21.283][vaultwarden::api::identity][ERROR] Invalid two factor provider

As per the discussion here, we could identify that upstream has refactored their recovery code handling and added a new type.

Originally posted by @shadow1runner in https://github.com/dani-garcia/vaultwarden/discussions/6200

Originally created by @shadow1runner on GitHub (Aug 20, 2025). Original GitHub issue: https://github.com/dani-garcia/vaultwarden/issues/6203 Originally assigned to: @BlackDex on GitHub. I've enabled two 2FA mechanisms: mail and authenticator app. Following the [upstream docs](https://bitwarden.com/help/two-step-recovery-code/#use-your-recovery-code), I'm trying to recover using the recovery code which I've just copied from <https://mydomain.example.localhost/#/settings/security/two-factor> (alongside the user name and master password, of course). I do not get an error in the web UI, but I'm just redirected to the main login view; the network pane reads as follows: <img width="631" height="126" alt="image" src="https://github.com/user-attachments/assets/d27383f4-5bff-4659-a203-f449990f4333" /> The log shows a single line: > vaultwarden-5d964b5d76-zqmsr [2025-08-19 22:49:21.283][vaultwarden::api::identity][ERROR] Invalid two factor provider As per the discussion [here](https://github.com/dani-garcia/vaultwarden/discussions/6200#discussioncomment-14161185), we could identify that upstream has refactored their recovery code handling and added a new type. _Originally posted by @shadow1runner in https://github.com/dani-garcia/vaultwarden/discussions/6200_
GiteaMirror added the good first issuebug labels 2026-06-17 09:31:50 -05:00
GiteaMirror commented 2026-06-17 09:31:52 -05:00
Author
Owner
Copy Link

@AdityAV42 commented on GitHub (Aug 30, 2025):

Hey I am also facing the same issue. THe Recovery Code is not working. It fails to reset Two-Step Login (MFA). The provided recovery code from the Web Vault does not allow me to bypass Two-Step Login (MFA). When I enter the code, the app still prompts me for my master password.

Steps to Reproduce:

  1. Log out of the mobile app/ website completely.
  2. Attempt to log in with my master password.
  3. When prompted for the Two-Step Login code, select the option to use the recovery code.
  4. Paste the recovery code into the provided field.

  • Expected Behavior
    The recovery code should reset or disable my MFA, and allow me to log in without needing a Two-Step Login code.

  • Actual Behavior:
    After entering the recovery code, I am still prompted to enter my master password. Then again the MFA is asked.

Also how to change your recovery code manually?

<!-- gh-comment-id:3238940910 --> @AdityAV42 commented on GitHub (Aug 30, 2025): _Hey I am also facing the same issue. THe Recovery Code is not working. It fails to reset Two-Step Login (MFA). The provided recovery code from the Web Vault does not allow me to bypass Two-Step Login (MFA). When I enter the code, the app still prompts me for my master password._ Steps to Reproduce: 1. Log out of the mobile app/ website completely. 2. Attempt to log in with my master password. 3. When prompted for the Two-Step Login code, select the option to use the recovery code. 4. Paste the recovery code into the provided field. - Expected Behavior The recovery code should reset or disable my MFA, and allow me to log in without needing a Two-Step Login code. - Actual Behavior: After entering the recovery code, I am still prompted to enter my master password. Then again the MFA is asked. _Also how to change your recovery code manually?_
GiteaMirror commented 2026-06-17 09:31:53 -05:00
Author
Owner
Copy Link

@BlackDex commented on GitHub (Aug 30, 2025):

This issue is already resolved in the current testing tagged image.
Only way to disable/remove mfa is via the admin backend /admin.
There you can remove all mfa items per user.

<!-- gh-comment-id:3238975928 --> @BlackDex commented on GitHub (Aug 30, 2025): This issue is already resolved in the current `testing` tagged image. Only way to disable/remove mfa is via the admin backend `/admin`. There you can remove all mfa items per user.
GiteaMirror commented 2026-06-17 09:31:53 -05:00
Author
Owner
Copy Link

@AlexKalopsia commented on GitHub (Oct 7, 2025):

Also facing this issue, with the difference that this is happening to my admin account, which makes things quite a bit worse. Luckily I do have an open session and I managed to export everything, but yeah not great. Has the fix been merged in the latest image, or is it still in testing ?

<!-- gh-comment-id:3378639894 --> @AlexKalopsia commented on GitHub (Oct 7, 2025): Also facing this issue, with the difference that this is happening to my admin account, which makes things quite a bit worse. Luckily I do have an open session and I managed to export everything, but yeah not great. Has the fix been merged in the latest image, or is it still in `testing` ?
GiteaMirror commented 2026-06-17 09:31:54 -05:00
Author
Owner
Copy Link

@codedge commented on GitHub (Oct 19, 2025):

I used the testing image and can confirm the recovery code works now. In the latest image it still is broken (redirect to login page).

<!-- gh-comment-id:3419572912 --> @codedge commented on GitHub (Oct 19, 2025): I used the `testing` image and can confirm the recovery code works now. In the `latest` image it still is broken (redirect to login page).
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
better for forum
bug
documentation
duplicate
enhancement
future Vault
good first issue
help wanted
low priority
notes
pull-request
Mirrored from GitHub Pull Request
 question
SSO
Third party
troubleshooting
wontfix
No Label bug good first issue
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/vaultwarden#29860
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?