ACME HQDemo work items and pages, made up for Emargen's demo. Not a real company.
Engineering / ENG-1481

Recovery codes can be used twice

Project
Engineering
Type
Bug
Status
Done Done
Priority
Highest
Reporter
Mira Holm <mira.holm@acme-hq.example>
Assignee
Marek Nowak <marek.nowak@acme-hq.example>
Labels
securitymfa
Components
identity-service
Fix versions
identity-service 2026.06.05
Sprint
Sprint 43
Parent
ENG-1431 MFA for administrators
Created
4 Jun 2026, 13:10 UTC
Updated
5 Jun 2026, 09:20 UTC
Resolved
5 Jun 2026, 09:20 UTC

Description

Found testing on staging.

Steps to reproduce

  1. Set up MFA, keep the recovery codes.
  2. Sign in with recovery code #1. Sign out.
  3. Sign in with recovery code #1 again.

Expected: refused. Actual: signed in.

The code is marked used in a job after the session starts. Mark it used in the same transaction that checks it.

Comments (0)

No comments.