#15562·opencart

2FA for one admin blocks another

Author: BellesonCreated Jul 9, 2026Updated Jul 18, 2026

OC 4.1.0.3

Describe the bug When 2FA is on, one admin can sign in and get a code, which logs out and locks out another admin with no 2FA code email. This surfaced as a problem while working in USA with extension developer in India to debug an extension.

What section does it affect? System->Settings->Server->Two factor authentication

To Reproduce

  1. Set up two admin accounts with full permissions
  2. On one browser, log in as admin one
  3. As admin one, set System->Settings->Server->Two factor authentication INACTIVE
  4. On another (different) browser, with separate cookies, log in as admin two
  5. As admin one, set System->Settings->Server->Two factor authentication set ACTIVE
  6. Presumably admin one gets email with 2FA code, enter code and go to Dashboard
  7. Go to admin 2 browser, click Dashboard
  8. Admin two sees screen to enter 2FA code
  9. Admin two no longer has access to application

Server / Test environment (please complete the following information):

  • web server deployment
  • Operating System | linux
  • PHP version 8.1
  • CPanel Version | 134.0 (build 44)
  • Apache Version | 2.4.68
  • mySql database Version | 8.0.46
  • Architecture | x86_64
  • Browser(s) with Firefox 133.0.3 (64-bit) and unknown

Additional context It appears 2FA should be tied to each admin login?