Missing Backup Recovery Codes During 2FA Enrollment

linkResolution: ❌

Reports that do not describe a security issue

General security/standards advice or best-practice suggestions


linkReport

Summary;
The 2FA activation process does not provide the user with a backup key or recovery code after enabling two-factor authentication.
 
If the user loses access to their authenticator device there is no any visible backup/recovery method available to regain access to the account...
 
Steps to Reproduce;
Log in to your account.
Navigate to Security / Two-Factor Authentication.
Enable 2FA.
Complete the activation process using an authenticator application.
Observe that no backup key or recovery codes are provided or configured.
Impact;
Users may permanently lose access to their accounts if they lose or reset the device containing their authenticator, potentially requiring manual account recovery.
 
Fix;
Provide users with securely generated, single-use recovery codes or a backup key during 2FA enrollment. Recovery codes should be displayed only once & stored securely by the user.