[GH-ISSUE #6203] 2FA Recovery Code no longer working #2370

New issue

Closed

opened 2026-03-03 02:17:41 +03:00 by kerem · 4 comments

kerem commented

2026-03-03 02:17:41 +03:00

Owner

Originally created by @shadow1runner on GitHub (Aug 20, 2025).
Original GitHub issue: https://github.com/dani-garcia/vaultwarden/issues/6203

Originally assigned to: @BlackDex on GitHub.

I've enabled two 2FA mechanisms: mail and authenticator app.
Following the upstream docs, I'm trying to recover using the recovery code which I've just copied from https://mydomain.example.localhost/#/settings/security/two-factor (alongside the user name and master password, of course).

I do not get an error in the web UI, but I'm just redirected to the main login view; the network pane reads as follows:

The log shows a single line:

vaultwarden-5d964b5d76-zqmsr [2025-08-19 22:49:21.283][vaultwarden::api::identity][ERROR] Invalid two factor provider

As per the discussion here, we could identify that upstream has refactored their recovery code handling and added a new type.

Originally posted by @shadow1runner in https://github.com/dani-garcia/vaultwarden/discussions/6200

Originally created by @shadow1runner on GitHub (Aug 20, 2025). Original GitHub issue: https://github.com/dani-garcia/vaultwarden/issues/6203 Originally assigned to: @BlackDex on GitHub. I've enabled two 2FA mechanisms: mail and authenticator app. Following the [upstream docs](https://bitwarden.com/help/two-step-recovery-code/#use-your-recovery-code), I'm trying to recover using the recovery code which I've just copied from <https://mydomain.example.localhost/#/settings/security/two-factor> (alongside the user name and master password, of course). I do not get an error in the web UI, but I'm just redirected to the main login view; the network pane reads as follows: <img width="631" height="126" alt="image" src="https://github.com/user-attachments/assets/d27383f4-5bff-4659-a203-f449990f4333" /> The log shows a single line: > vaultwarden-5d964b5d76-zqmsr [2025-08-19 22:49:21.283][vaultwarden::api::identity][ERROR] Invalid two factor provider As per the discussion [here](https://github.com/dani-garcia/vaultwarden/discussions/6200#discussioncomment-14161185), we could identify that upstream has refactored their recovery code handling and added a new type. _Originally posted by @shadow1runner in https://github.com/dani-garcia/vaultwarden/discussions/6200_

kerem

2026-03-03 02:17:41 +03:00

closed this issue
added the
good first issue

bug
labels

kerem commented

2026-03-03 02:17:42 +03:00

Author

Owner

@AdityAV42 commented on GitHub (Aug 30, 2025):

Hey I am also facing the same issue. THe Recovery Code is not working. It fails to reset Two-Step Login (MFA). The provided recovery code from the Web Vault does not allow me to bypass Two-Step Login (MFA). When I enter the code, the app still prompts me for my master password.

Steps to Reproduce:

Log out of the mobile app/ website completely.
Attempt to log in with my master password.
When prompted for the Two-Step Login code, select the option to use the recovery code.
Paste the recovery code into the provided field.

Expected Behavior
The recovery code should reset or disable my MFA, and allow me to log in without needing a Two-Step Login code.
Actual Behavior:
After entering the recovery code, I am still prompted to enter my master password. Then again the MFA is asked.

Also how to change your recovery code manually?

@AdityAV42 commented on GitHub (Aug 30, 2025): _Hey I am also facing the same issue. THe Recovery Code is not working. It fails to reset Two-Step Login (MFA). The provided recovery code from the Web Vault does not allow me to bypass Two-Step Login (MFA). When I enter the code, the app still prompts me for my master password._ Steps to Reproduce: 1. Log out of the mobile app/ website completely. 2. Attempt to log in with my master password. 3. When prompted for the Two-Step Login code, select the option to use the recovery code. 4. Paste the recovery code into the provided field. - Expected Behavior The recovery code should reset or disable my MFA, and allow me to log in without needing a Two-Step Login code. - Actual Behavior: After entering the recovery code, I am still prompted to enter my master password. Then again the MFA is asked. _Also how to change your recovery code manually?_

kerem commented

2026-03-03 02:17:42 +03:00

Author

Owner

@BlackDex commented on GitHub (Aug 30, 2025):

This issue is already resolved in the current testing tagged image.
Only way to disable/remove mfa is via the admin backend /admin.
There you can remove all mfa items per user.

@BlackDex commented on GitHub (Aug 30, 2025): This issue is already resolved in the current `testing` tagged image. Only way to disable/remove mfa is via the admin backend `/admin`. There you can remove all mfa items per user.

kerem commented

2026-03-03 02:17:42 +03:00

Author

Owner

@AlexKalopsia commented on GitHub (Oct 7, 2025):

Also facing this issue, with the difference that this is happening to my admin account, which makes things quite a bit worse. Luckily I do have an open session and I managed to export everything, but yeah not great. Has the fix been merged in the latest image, or is it still in testing ?

@AlexKalopsia commented on GitHub (Oct 7, 2025): Also facing this issue, with the difference that this is happening to my admin account, which makes things quite a bit worse. Luckily I do have an open session and I managed to export everything, but yeah not great. Has the fix been merged in the latest image, or is it still in `testing` ?

kerem commented

2026-03-03 02:17:42 +03:00

Author

Owner

@codedge commented on GitHub (Oct 19, 2025):

I used the testing image and can confirm the recovery code works now. In the latest image it still is broken (redirect to login page).

@codedge commented on GitHub (Oct 19, 2025): I used the `testing` image and can confirm the recovery code works now. In the `latest` image it still is broken (redirect to login page).