Newly created admin users are unable to pass Two-Factor Authentication

[m9iqbal]

Our production site, as well as our QA servers, are all having an issue with passing the 2-factor authentication in admin panel.

When a newly created admin user scans the QR code after providing their username and password, and enters the 6-digit code shown on the Google Authenticator app, they are consistently given an "Invalid code" error. However, if an existing admin resets their Google Authenticator 2FA settings under User Accounts, the new user can scan the QR code and enter the 6-digit code with no issue. This should ideally work without resetting the 2FA. This is not happening on any old accounts, only new ones.

Preconditions (*)

1. Magento version 2.3.5-p1
2. msp/twofactorauth package at version 3.1.2

Steps to reproduce (*)

1. Enable 2FA for admin login
2. Login to the Admin Panel

Expected result (*)

1. Admins are able to scan the QR code and input the 6-digit code shown on the authenticator app

Actual result (*)

1. Admins are not able to pass the 2-factor authentication after scanning the QR code and inputing the 6-digit code shown on the authenticator app

[m2-assistant[bot]]

Hi @m9iqbal. Thank you for your report. To help us process this issue please make sure that you provided sufficient information.

Please, add a comment to assign the issue: @magento I am working on this

---

• Join Magento Community Engineering Slack and ask your questions in #github channel.

[m9iqbal]

Yes, all required information has already been provided.

[nathanjosiah]

Hello @m9iqbal, can you confirm this is happening every time for every admin? We have a known bug that has been addressed in the upcoming 2.4.3 that affect iPhone specifically allowing codes to be scanned properly

[nathanjosiah]

Closing due to unable to reproduce and lack of response. Please provide exact steps with a fresh install