2FA for one admin blocks another
Author: BellesonCreated Jul 9, 2026Updated Jul 18, 2026
OC 4.1.0.3
Describe the bug When 2FA is on, one admin can sign in and get a code, which logs out and locks out another admin with no 2FA code email. This surfaced as a problem while working in USA with extension developer in India to debug an extension.
What section does it affect? System->Settings->Server->Two factor authentication
To Reproduce
- Set up two admin accounts with full permissions
- On one browser, log in as admin one
- As admin one, set System->Settings->Server->Two factor authentication INACTIVE
- On another (different) browser, with separate cookies, log in as admin two
- As admin one, set System->Settings->Server->Two factor authentication set ACTIVE
- Presumably admin one gets email with 2FA code, enter code and go to Dashboard
- Go to admin 2 browser, click Dashboard
- Admin two sees screen to enter 2FA code
- Admin two no longer has access to application
Server / Test environment (please complete the following information):
- web server deployment
- Operating System | linux
- PHP version 8.1
- CPanel Version | 134.0 (build 44)
- Apache Version | 2.4.68
- mySql database Version | 8.0.46
- Architecture | x86_64
- Browser(s) with Firefox 133.0.3 (64-bit) and unknown
Additional context It appears 2FA should be tied to each admin login?
Source: opencart/opencart