Repository navigation
Why does the default "reset credentials" flow not require OTP (when configured) before allowing password reset? #35663
Unanswered
ryanmaffey
asked this question in
Q&A
Replies: 1 comment
|
Hi, I faced the same issue and my team found similar tickets with more activity on it: |
0 replies
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
-
Reference
Uh oh!
There was an error while loading. Please reload this page.
Keycloak version
24.0.6
The scenario
I have an account with 2-Factor Authentication (2FA) set up. I have access to my 2FA method but I've forgotten my password and need to reset it.
Default behaviour
Given I have an account with 2-Factor Authentication (2FA) set up.
When I go through the "reset password" flow using the "Forgot Password?" link.
And I receive the password rest email.
When I click the link in the email.
Then I land on a page asking me to setup an additional 2FA method.
When I setup a new 2FA method.
Then I am taken to the password reset page.
When I enter my new password and submit the form.
Then I've updated my password successfully.
I now have a new password and a potentially unnecessary second 2FA method configured.
The issue
If a bad actor were to get access to my email account they're able to achieve all of this and lock me out of my account. There's no requirement to use the 2FA method I've already set up prior to resetting the password. Instead it gives the bad actor the ability to set up their own 2FA method to gain access to the account.
Expected behaviour
Given I have an account with 2-Factor Authentication (2FA) set up.
When I go through the "reset password" flow using the "Forgot Password?" link.
And I receive the password rest email.
When I click the link in the email.
Then I land on a page asking for the one-time code from my configured 2FA method.
When I provide the one-time code.
Then I am taken to the password reset page.
When I enter my new password and submit the form.
Then I've updated my password successfully.
I now have a new password only.
The questions
All reactions