The two-step verification value could not be confirmed

[Saarbruecken]

After upgrading to 2.3.6 we cannot log on with 2FA protected user accounts (using a 2FA App). I have the issue on both of my websites.
Even disabling 2FA and then re-enabling 2FA again won't work, I keep getting "The two-step verification value could not be confirmed".

Date and Time is up to date on my server. I also didn't touch the Cloudflare settings lately. No third-party add-ons are present, just Enhanced Search on website one and the three official XF add-ons on website two. I also have tried a different browser.

Server OS is Debian 12. No Server Errors in the Admin Panel either. Passkeys are working fine.

Any ideas? Can anyone else reproduce this?

 

[Mendalla]

I have 2FA via authenticator active on both my user and admin accounts and no problems seen since upgrading to 2.3.6 so it is probably something in your environment.

 

[lazy llama]

After upgrading to 2.3.6 we cannot log on with 2FA protected user accounts (using a 2FA App). I have the issue on both of my websites.
…

Server OS is Debian 12. No Server Errors in the Admin Panel either. Passkeys are working fine.

Any ideas? Can anyone else reproduce this?

Are both sites on the same server?
Are you using any caching, e.g memcached?
I had an issue upgrading from 2.2 to 2.3 where the cache config format differs slightly and one of the effects was that 2FA broke.

 

[Saarbruecken]

Yeah, both websites are on the same server and I am using APCU. Opcache is already disabled in php.ini

I turned off APCU and also disabled it in the config.php, however the problem still persists.

Edit:
Now forum number 3 is affected. :/

I have no idea what is causing this!

 

[Saarbruecken]

This is just weird. Passkeys are working... Mail is working... just the 2FA App isn't. No logs, no errors in Apache, no XenForo errors.

 

[MentaL]

Thread 'Connected account request error (microsoft)'

Feb 13, 2025

Validation passes using test provider at admin.php?connected-accounts.

XF\ConnectedAccount\Http\HttpResponseException: Connected account request error (microsoft): Failed to request resource. HTTP Code: 410 src/XF/ConnectedAccount/Http/Client.php:67
Generated by: Unknown account Feb 13, 2025 at 12:26 PM
Stack trace
#0 src/vendor/lusitanian/oauth/src/OAuth/OAuth2/Service/AbstractService.php(175): XF\ConnectedAccount\Http\Client->retrieveResponse(Object(OAuth\Common\Http\Uri\Uri), NULL, Array, 'GET')
#1 src/XF/ConnectedAccount/ProviderData/AbstractProviderData.php(101)...

• MentaL
• Replies: 13
• Forum: Bug reports

• 

 

[Saarbruecken]

Even if I completely remove 2FA from my account, when I try to re-enable it again and choose 2FA app, I am not able to complete this step. E-Mail works just fine, just the app no longer works. Microsoft Authenticator, Google Authenticator, 2FA App...

 

[Saarbruecken]

Just in case someone is stumbling over the same problem.

Linux Containers (e. g. when using Proxmox) won't sync the time, or better they have no permission to do this.

CLOCK: local_clock: ntpd/ntp_loopfilter.c line 792: ntp_adjtime: Operation not permitted

Even though the Linux Container properly confirms every time sync, it's completely useless.

2025-02-25T20:31:59 ntpd[12756]: CLOCK: time slew +0.000773 s
ntpd: time slew +0.000773s

You won't experience this problem with a VM (QEMU) though.

Remember: Make sure NTP is still running on your hypervisor. Something was broken after the upgrade a couple of months ago...

 

[MentaL]

Just in case someone is stumbling over the same problem.

Linux Containers (e. g. when using Proxmox) won't sync the time, or better they have no permission to do this.

CLOCK: local_clock: ntpd/ntp_loopfilter.c line 792: ntp_adjtime: Operation not permitted

Even though the Linux Container properly confirms every time sync, it's completely useless.

2025-02-25T20:31:59 ntpd[12756]: CLOCK: time slew +0.000773 s
ntpd: time slew +0.000773s

You won't experience this problem with a VM (QEMU) though.

Remember: Make sure NTP is still running on your hypervisor. Something was broken after the upgrade a couple of months ago...

and by chance, I am using proxmox.