Resetting password bypasses 2FA

  • Resolved PerfectSolution

    (@perfectsolution)


    2 years, 1 month ago

    Hi guys,

    We’re using your plugin in combination with WooCommerce. We’ve noticed that when resetting your password on a 2FA secured account via the WooCommerce “forgot password” form, the user is being logged in without being asked for 2FA during the initial sign in process.

    Logging out and back in, after resetting the password, will prompt for 2FA again. So, it seems to happen only when the user is being logged in during the reset request.

    I would consider this a security risk, but I would like to hear your opinion on this. Is it intentional behavior?

Viewing 6 replies - 1 through 6 (of 6 total)
  • Plugin Contributor robertabela

    (@robert681)

    Thank you for using our plugin @perfectsolution

    Before answering your question I would like to confirm something; do you mean the user is logged in, and changes the password while logged in?

    Looking forward to hearing from you.

    Thread Starter PerfectSolution

    (@perfectsolution)

    Hi @robert681

    No, the user is not logged in. The user is a non-logged in visitor requesting to reset password via WooCommerce’s forgot password form.

    Plugin Contributor robertabela

    (@robert681)

    Thank you for the clarification @perfectsolution

    We are running a number of tests today to try this. We’ll keep you updated. In the meantime, should there be anything else, do not hesitate to ask.

    Have a great day.

    Plugin Contributor robertabela

    (@robert681)

    Hello @perfectsolution

    We have done a lot of testing and cannot reproduce this. It seems like we are missing some detail. Can you please share a video in which you can highlight the step by step process and highlight the issue?

    To avoid sharing sensitive details on these forums, you can send us the video and all the details via email at [email protected].

    We look forward to hearing from you.

    Thread Starter PerfectSolution

    (@perfectsolution)

    Hi @robert681

    After some more debugging, I managed to locate a small snippet in our source that was hooking into woocommerce_customer_reset_password and logging in users automatically after resetting the password. This action bypassed the 2FA.

    The problem was entirely on our end. I am very sorry about that.

    Thank you for taking time to test it and get back to us though. I wish you a pleasant day!

    Plugin Contributor robertabela

    (@robert681)

    Thank you very much for the update @perfectsolution

    No need to apologize. These things happen. As long as the source of the problem was found, all is good. Should you have any other questions, please do not hesitate to ask.

    By the way, please spare a minute to rate our plugin and service. These ratings are really helpful.

    Thank you and have a great day.

Viewing 6 replies - 1 through 6 (of 6 total)
  • The topic ‘Resetting password bypasses 2FA’ is closed to new replies.