Forum Discussion
JWhitesPro_1928
Cirrostratus
CirrostratusOTP can be bypassed by refreshing on the OTP prompt page..
Has anyone ran into this issue?
On 11.6HF6
If you're at a step in your access policy of prompting for a OTP and the user just refreshes the browser, it bypasses everything else in the polic...
JWhitesPro_1928Cirrostratus
CirrostratusI think it may be a bug...as I said it doesn't happen on mobile devices--and in the logs I see this right before it goes on to allow the user through even though they typed nothing in.
modules/Authentication/OTP/OTPVerifyAgent.cpp func: "getOTPVerifyUserInput()" line: 149 Msg: 64d04990: OTP_VERIFY Agent: getOTPVerifyUserInput(): unable to decrypt user password due to invalid ciphertext
JWhitesPro_1928Cirrostratus
CirrostratusIt may be something specific to the steps I have. I just created a very basic new policy and wasn't able to reproduce right away. I will message you the .