2FA removal UI displays incorrect message about recovery codes
Closed, ResolvedPublicBUG REPORT
Actions

Assigned To

Authored By

	TBurmeister
	Nov 24 2025, 8:12 PM

Description

Steps to replicate the issue (include links if applicable):

Have more than one authenticator app enrolled
In Special:Accountsecurity, click the option to disable one of your authenticator apps

What happens?:

The UI displays the message (oathauth-delete-warning): "You won't be able to use this authentication method to log in anymore and your recovery codes will no longer work"

What should have happened instead?:

The removal of an authentication method should have no effect on whether existing recovery codes function. We currently claim this is true on the project page for 2FA.

Other information (browser name/version, screenshots, etc.):

T405872

Screenshot from 2025-11-21 14-42-01.png (555×1 px, 46 KB)

Details

Related Changes in Gerrit:

	Subject	Repo	Branch	Lines +/-
	Delete passkeys when final 2FA method is deleted	mediawiki/extensions/OATHAuth	master	+27 -36

Customize query in gerrit

Related Objects

Mentioned Here: rMW12358ded9740: Update git submodules
T405872: Tell users disabling last 2FA removes recovery codes

Event Timeline

TBurmeister created this task.Nov 24 2025, 8:12 PM

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptNov 24 2025, 8:12 PM

Catrope added a project: FY2025-26 WE 4.6 - Account Security (WE 4.6.4 - 2FA improvements and passkey support).Nov 24 2025, 8:33 PM

Catrope moved this task from Inbox to Bugs on the FY2025-26 WE 4.6 - Account Security (WE 4.6.4 - 2FA improvements and passkey support) board.

Playing around with this a bit locally, I think we either need to change the copy for the oathauth-delete-warning message or introduce a different code path/message. Because the code appears to be working properly in recognizing existing/remaining auth app keys. When I inspect $lastKey, $this->isPrivilegedUser() and even count( $remainingKeys ), all of those appear correct when I have 2+ auth app keys set for my account. But the only path the code can take in this case is rendering the oathauth-delete-warning message via: Html::element( 'p', [], $this->msg( 'oathauth-delete-warning' )->text() ) ); on line 641 of OATHManage.php.

Reedy added a project: MW-1.45-release.Nov 26 2025, 9:53 AM

Mstyles claimed this task.Dec 8 2025, 4:11 PM

In my test on jawiki, I found that deleting security key can also show this incorrect warning. FYR.

Restricted Application added a subscriber: Dragoniez. · View Herald TranscriptDec 14 2025, 9:15 AM

Change #1217316 had a related patch set uploaded (by Mstyles; author: Mstyles):

[mediawiki/extensions/OATHAuth@master] Delete passkeys when final 2FA method is deleted

https://gerrit.wikimedia.org/r/1217316

gerritbot added a project: Patch-For-Review.Dec 16 2025, 12:51 AM

Change #1217316 merged by jenkins-bot: