2FA Policy not enforced after removing a users 2FA through the Admin interface #1667

New Issue

OVERLORD · 2026-02-05T01:27:54+03:00

OVERLORD commented

2026-02-05 01:27:54 +03:00

Originally created by @FreeMinded on GitHub (Aug 26, 2023).

Subject of the issue

The Admin Panel allows to remove 2FA configurations from a user (which is great). Unfortunately the user is neither removed from the organization nor requested to setup 2FA again at the next login if he is part of an organization with 2FA Policy. The user still has full access to this organization. So it’s a way to circumvent the 2FA policy, presenting a security flaw.

See Forum Discussion

Deployment environment

Vaultwarden Version 2023.5.0

Steps to reproduce

Invite a user to an organization with 2FA policy & complete process to give user access (user will be forced to configure 2FA)
Remove users 2FA from the /admin Interface
Login a user (no 2FA will be required anymore)
User still has access to organization with 2FA policy

Expected behaviour

With the removal of the 2FA settings for a user in the /admin Interface the user should be removed from any organization with 2FA policy.

This would be consistent with the current behavior. When a user removes his 2FA settings himself, he gets removed from all organizations with 2FA policy.

Actual behaviour

User still has access to organization with 2FA policy despite not having 2FA configured.

Originally created by @FreeMinded on GitHub (Aug 26, 2023). ### Subject of the issue The Admin Panel allows to remove 2FA configurations from a user (which is great). Unfortunately the user is neither removed from the organization nor requested to setup 2FA again at the next login if he is part of an organization with 2FA Policy. The user still has full access to this organization. So it’s a way to circumvent the 2FA policy, presenting a security flaw. See [Forum Discussion](https://vaultwarden.discourse.group/t/2fa-policy-not-enforced-after-removing-a-users-2fa-settings/2875) ### Deployment environment Vaultwarden Version 2023.5.0 ### Steps to reproduce 1. Invite a user to an organization with 2FA policy & complete process to give user access (user will be forced to configure 2FA) 2. Remove users 2FA from the /admin Interface 3. Login a user (no 2FA will be required anymore) 4. User still has access to organization with 2FA policy ### Expected behaviour With the removal of the 2FA settings for a user in the /admin Interface the user should be removed from any organization with 2FA policy. This would be consistent with the current behavior. When a user removes his 2FA settings himself, he gets removed from all organizations with 2FA policy. ### Actual behaviour User still has access to organization with 2FA policy despite not having 2FA configured.

OVERLORD added the enhancement bug labels 2026-02-05 01:27:54 +03:00

OVERLORD closed this issue

2026-02-05 01:27:55 +03:00

OVERLORD commented

2026-02-05 01:27:57 +03:00

@BlackDex commented on GitHub (Aug 26, 2023):

Looks like we need to remove/disable a user if they disable/remove there 2FA, this is currently not the case.
Thanks for the report.

Keep in mind that a Owner or Admin is always able to login and access the Org, with or without 2FA enabled.

@BlackDex commented on GitHub (Aug 26, 2023): Looks like we need to remove/disable a user if they disable/remove there 2FA, this is currently not the case. Thanks for the report. Keep in mind that a Owner or Admin is always able to login and access the Org, with or without 2FA enabled.

OVERLORD commented

2026-02-05 01:27:59 +03:00

@FreeMinded commented on GitHub (Aug 26, 2023):

Keep in mind that a Owner or Admin is always able to login and access the Org, with or without 2FA enabled.

@BlackDex yes, I realized that. What is the reason for this behavior? Would make sense to enforce 2FA for owners and admins as well, doesn't it?

Actually thinking of it, this would be the argument for blocking access to an organization rather than remove the user from it completely when lacking 2FA. Otherwise you might have no one left to invite the user again. 🙈

@FreeMinded commented on GitHub (Aug 26, 2023): > Keep in mind that a Owner or Admin is always able to login and access the Org, with or without 2FA enabled. @BlackDex yes, I realized that. What is the reason for this behavior? Would make sense to enforce 2FA for owners and admins as well, doesn't it? Actually thinking of it, this would be the argument for blocking access to an organization rather than remove the user from it completely when lacking 2FA. Otherwise you might have no one left to invite the user again. :see_no_evil:

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/vaultwarden#1667