Repository navigation
Disable MFA without TOTP #9623
Description
New Issue Checklist
- Report security issues confidentially.
- Any contribution is under this license.
- Before posting search existing issues.
Issue Description
Originally posted by @SteffenKeller:
A logged-in user can disable MFA for their account without entering a valid verification code by simply calling the unlink function or saving null for the MFA auth data.
The TOTP auth adapter prevents setting a new secret without a valid code (AuthenticationAdapters.spec.js line 2413), but it does not prevent clearing the secret first and then setting a new one.
This may not be critical, but since the TOTP auth adapter was designed to require a valid code to disable mfa, I thought it was worth mentioning.
Steps to reproduce
JS SDK:
await user._unlinkFrom('mfa');
or
await user.save(
{ authData: { mfa: null } },
{ sessionToken: user.getSessionToken() }
);
Environment
Server
- Parse Server version:
FILL_THIS_OUT
Activity
parse-github-assistant commentedon Mar 2, 2025
Thanks for opening this issue!
FILL_THIS_OUT, otherwise your issue will be closed. If a field does not apply to the issue, fill inn/a.test: Stale MFA unlink bypass via skipped adapter validation (parse-c…
mtrezza commentedon Mar 22, 2026
In #10277 we show a way to prevent unsetting MFA with a beforeSave trigger. This is a universal solution that can contain any conditions to allow or reject unsetting MFA. While this is not a simple option in the adapter, it is a viable workaround.