https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43470 --- Comment #23 from Pedro Amorim (ammopt) <pedro.amorim@openfifth.co.uk> --- Hi all, the guard is not robust enough, the registration endpoint can still be reached using Basic Auth if the URL has a trailing slash: 1) Turn on 'TwoFactorAuthentication' and 'RESTBasicAuth' 2) In ktd --shell, mark koha as 2FA-enrolled: echo "UPDATE borrowers SET auth_method='two-factor' WHERE userid='koha'" | koha-mysql kohadev 3) Run: curl -u koha:koha -X POST http://localhost:8081/api/v1/auth/two-factor/registration 4) Notice {"error":"Cannot request this route."}, the patch blocks this 5) Run it again with a trailing slash: curl -u koha:koha -X POST http://localhost:8081/api/v1/auth/two-factor/registration/ 6) Notice you get a new 'secret32' and 'qr_code' back, the guard is bypassed 7) Undo, otherwise koha's staff login will ask for a 2FA code: echo "UPDATE borrowers SET auth_method='password' WHERE userid='koha'" | koha-mysql kohadev 'registration/verification/' should also be double-checked, as it's guarded by the same check. -- You are receiving this mail because: You are watching all bug changes.