You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cloudstack.apache.org by "davift (via GitHub)" <gi...@apache.org> on 2026/06/04 00:56:29 UTC

[I] [Hardening] F-06: 2FA Field Set as Password Causes Password Manager Issues. [cloudstack]

davift opened a new issue, #13337:
URL: https://github.com/apache/cloudstack/issues/13337

   ### The required feature described as a wish
   
   <img width="473" height="612" alt="Image" src="https://github.com/user-attachments/assets/b624e9d2-08f0-4593-8446-3214e93d68a6" />
   
   **Description:** The 2FA input is defined as type="password". Password managers treat it like a regular password field, so they may save or autofill the 2FA code. This can overwrite the stored password and lock the user out of their account. The field was likely set this way to hide the Static PIN from bystanders or during screen sharing.
   
   **Affected Components:** Management UI
   
   **Impact:** Password managers may replace saved passwords with 2FA codes. This can lock users out and lead them to choose weaker passwords or store them insecurely.
   
   **Steps to Reproduce:**
   - Log in to the CloudStack Management UI with a user that has 2FA enabled.
   - Enter valid credentials and continue to the 2FA screen.
   - Inspect the 2FA input field in the browser’s developer tools.
   - Confirm it is set to type="password".
   
   **Recommended Remediation:** Change the 2FA input field to type="number" and add autocomplete="one-time-code". This informs password managers of the field's actual meaning.
   
   Also, consider combining the password and 2FA into a single form. This way, attackers can’t tell which part failed, making password attacks harder.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] [Hardening] F-06: 2FA Field Set as Password Causes Password Manager Issues. [cloudstack]

Posted by "nvazquez (via GitHub)" <gi...@apache.org>.
nvazquez commented on issue #13337:
URL: https://github.com/apache/cloudstack/issues/13337#issuecomment-6501607070

   Thanks @davift - I see the PR https://github.com/apache/cloudstack/pull/13723 has been already merged. Marking this issue as completed


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] [Hardening] F-06: 2FA Field Set as Password Causes Password Manager Issues. [cloudstack]

Posted by "daviftorres (via GitHub)" <gi...@apache.org>.
daviftorres commented on issue #13337:
URL: https://github.com/apache/cloudstack/issues/13337#issuecomment-5048506676

   @DaanHoogland ,
   
   Here it is https://github.com/apache/cloudstack/pull/13671/changes


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] [Hardening] F-06: 2FA Field Set as Password Causes Password Manager Issues. [cloudstack]

Posted by "daviftorres (via GitHub)" <gi...@apache.org>.
daviftorres commented on issue #13337:
URL: https://github.com/apache/cloudstack/issues/13337#issuecomment-5047825141

   I will submit a PR for this chamge. It is extremely simple. Give me a few...


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] [Hardening] F-06: 2FA Field Set as Password Causes Password Manager Issues. [cloudstack]

Posted by "DaanHoogland (via GitHub)" <gi...@apache.org>.
DaanHoogland commented on issue #13337:
URL: https://github.com/apache/cloudstack/issues/13337#issuecomment-5046373467

   @davift , Do you have a change for this?


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] [Hardening] F-06: 2FA Field Set as Password Causes Password Manager Issues. [cloudstack]

Posted by "nvazquez (via GitHub)" <gi...@apache.org>.
nvazquez closed issue #13337: [Hardening] F-06: 2FA Field Set as Password Causes Password Manager Issues.
URL: https://github.com/apache/cloudstack/issues/13337


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org