Issue MFA "invalid code" on admin account. Cannot even re-enable.

[Poscolerep]

Plesk Obsidian 18.0.79 on Ubuntu 22.04.5 LTS

Hi everyone,

I'm having trouble getting Multi-Factor Authentication working again on my Plesk installation. I noticed the issue by chance when a login attempt failed with an invalid code error.
At that point I disabled MFA via CLI.

Now I want to re-enable it, but every verification code I try (freshly scanned QR, manually entered secret, different attempts over time, different mobile phone) gets rejected as "not valid" even during initial setup.

What I have already tried:

Checked server time with timedatectl status and timedatectl timesync-status.
NTP is active, offset is only -26ms.

Confirmed the phone's date/time is set to automatic network sync, not manual.

Disabled and re-enabled MFA from the GUI and from CLI
Fully uninstalled and reinstalled the extension (GUI and CLI)
Tried a fresh QR code setup in an incognito browser window, and additional browser.

Despite all this, a freshly generated code is still rejected as invalid, both for admin login and for initial setup.

Has anyone run into something similar?
Any pointers on where else to look (extension specific logs, database tables, etc.) would be much appreciated.

Thanks in advance.

 

[Sebahat.hadzhi]

Hi, @Poscolerep . Please check if any relevant errors are being logged into /var/log/plesk/panel.log. If nothing is being logged it is worth to temporarily enable Plesk debug mode. T most common issues are with the server time and NTP being off. Frankly, I cannot think of another reason that could be causing the issue.

 

[Carl Swart]

Hi,

I am seeing similar behaviour from:

Multi-Factor Authentication (MFA)
Version 1.3.0-9522

On Plesk:

Product version: Plesk Obsidian 18.0.78.4
OS version: AlmaLinux 10.2 x86_64
Build date: 2026/06/17 20:00
Revision: 65744d3a14d3a1f2034269b41c53008e95340915

I had to disable MFA to gain access to the CP and I know that MFA worked 100% previously.

I am now unable to enable MFA again, all I get is: 'Invalid Code'

I tried enabling debug mode as pointed to in the previous post. Debug mode logged many things, but nothing relating to MFA.

I also verified that the server time and client time is within a 1 second difference of each other, but still I am informed that I am presenting the wrong code to the challenge.

I even tried using multiple clients to generate the code, but they all generate the same code and all codes are being rejected.

Please help?

 

[Sebahat.hadzhi]

Hi, @Carl Swart . If you don't mind, could you please still attach a copy of the logs? You can DM it to me if more convenient.

 

[Sebahat.hadzhi]

@Carl Swart was nice enough to provide me with logs. Unfortunately, I was unable to locate any entries that indicate why the code is being rejected. At this point, the only suggestion I have is opening a ticket with Plesk support for further investigation on the servers. To sign-in and open a ticket please go to:

• https://support.plesk.com

If you got your license from a reseller, your reseller is in charge of providing you with support. You can raise the inquiry with them and they can forward it to our team for further processing. If the reseller does not provide support, here is an alternative to get support directly from Plesk:

• https://support.plesk.com/hc/en-us/articles/12388090147095-How-to-get-support-directly-from-Plesk