2FA bypass glitch

TrueNAS General
1

I managed to bypass the web interface’s 2FA.

I have 2FA enabled for the truenas_admin and I am using it several times per day for the last 3 days.

This evening I entered truenas_admin and the corresponding password and at that point I was asked to join dinner. So I left the 2FA empty and I joined dinner.

20-40 minutes later (I don’t know exactly) I came back on my laptop and I clicked proceed with the intention to get an error and refresh.

To mu surprise I managed to login without 2FA code!!! I am sure this is not normal and I saw a glitch. I am new to TrueNAS but I work in IT for 20+ years.

Any suggestions of what might be wrong?

2

Can you reproduce? If you can reproduce, I would use Report a Bug in the GUI, (smile icon on upper right for Feedback/Report a Bug) or Report a Bug on forum, upper right, top. Make sure to attach a debug dump and post the ticket number or a link to the Jira, here in the forum thread.

3

Did you user username / password to authenticate without 2FA or did you simply get into the UI (the latter can happen if you never logged out of the UI).

4

I tried more than 20 times to reproduce but I couldn’t. This is why I wrote here, not in the Jira directly. I will trying.

5

I simply got into the UI. I thought initially it is a cached content and I clicked here and there to check that I am actually in the UI.

6

So it’s not really bypassing 2FA. It sounds like it still had a session open and you picked up where you left off.

7

Yes, it sounds exactly like this. I’ve made one more test: I logged in in one browser tab, then opened another browser tab in the same window. The second browser tab did not login directly to the TrueNAS interface and requires me to enter user/pass/2fa for login all together again.

I cannot reproduce this issue and I will not file a bug. I will be thinking what happened and will someone else be able to do it as well.