[PR #1072] [MERGED] fix: enforce 2FA for email password SSO linked accounts #1363

New issue

Closed

opened 2026-02-26 19:32:56 +03:00 by kerem · 0 comments

kerem commented

2026-02-26 19:32:56 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/documenso/documenso/pull/1072
Author: @dguyen
Created: 4/2/2024
Status: ✅ Merged
Merged: 4/3/2024
Merged by: @dguyen

Base: main ← Head: fix/2fa-for-mixed-sso-user-accounts

📝 Commits (2)

cfc1036 fix: enforce 2FA for email password SSO linked accounts
deeffb2 fix: tests

📊 Changes

3 files changed (+5 additions, -9 deletions)

View changed files

📝 packages/app-tests/e2e/pr-718-add-stepper-component.spec.ts (+2 -2)
📝 packages/app-tests/e2e/test-auth-flow.spec.ts (+1 -1)
📝 packages/lib/server-only/2fa/is-2fa-availble.ts (+2 -6)

📄 Description

Description

Fixed issue where accounts that were initially created via email/password, then linked to an SSO account, can bypass the 2FA during login if they use their email password.

Testing Performed

Tested locally, and 2FA is now required for linked SSO accounts

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/documenso/documenso/pull/1072 **Author:** [@dguyen](https://github.com/dguyen) **Created:** 4/2/2024 **Status:** ✅ Merged **Merged:** 4/3/2024 **Merged by:** [@dguyen](https://github.com/dguyen) **Base:** `main` ← **Head:** `fix/2fa-for-mixed-sso-user-accounts` --- ### 📝 Commits (2) - [`cfc1036`](https://github.com/documenso/documenso/commit/cfc1036267f76d02253a8bc6b6b3683af93bb030) fix: enforce 2FA for email password SSO linked accounts - [`deeffb2`](https://github.com/documenso/documenso/commit/deeffb2e33024f154d51e48f5b454218c39a7752) fix: tests ### 📊 Changes **3 files changed** (+5 additions, -9 deletions) <details> <summary>View changed files</summary> 📝 `packages/app-tests/e2e/pr-718-add-stepper-component.spec.ts` (+2 -2) 📝 `packages/app-tests/e2e/test-auth-flow.spec.ts` (+1 -1) 📝 `packages/lib/server-only/2fa/is-2fa-availble.ts` (+2 -6) </details> ### 📄 Description ## Description Fixed issue where accounts that were initially created via email/password, then linked to an SSO account, can bypass the 2FA during login if they use their email password. ## Testing Performed Tested locally, and 2FA is now required for linked SSO accounts --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

kerem

2026-02-26 19:32:56 +03:00

closed this issue
added the
pull-request
label

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

starred/documenso#1363

No description provided.

Rows
Columns