I second this feature request. I’ve also created a similar feature request, specifically to require their current password as a second factor in order to reset. This is in line with OWASP 4.0 ASVS 2.1.6 requirements - https://owasp.org/www-pdf-archive/OWASP_Application_Security_Verification_Standard_4.0-en.pdf
Related topics
| Topic | Replies | Views | Activity | |
|---|---|---|---|---|
| Enforce MFA on the Password Reset Page | 1 | 30 | September 13, 2024 | |
| Feature request: Allow linking to password reset page without state | 1 | 1590 | May 6, 2022 | |
| Feature request: Change password flow that requires the current password as a factor | 1 | 967 | July 11, 2023 | |
| Issue with Password Reset Emails for Email-Based Authentication Users During Shift to Password Authentication | 0 | 983 | March 2, 2023 | |
| MFA in forgot password flow | 5 | 4368 | July 20, 2023 |