goauthentik / goauthentik/authentik

MFA Enroll Method shown even with denied permissions

Open
#19,136 1 comment 0 reactions 0 assignees View on GitHub
bug/confirmed
Dominant language
Python
Stars
25.6k
Forks
2k
Avg merge
1d 1h
Merged PRs (30d)
644

Description

### Describe the bug

Even when declining explicit access to a MFA enroll method, it remains shown in the user UI:

Image

### How to reproduce

1. The respective MFA method is associated to the default flow:
Image

2. The respective default flow remains unchanged and has one permission set explicitly denying access:
Image

Done this way by negating the result:
Image

3. What's interesting is, that opening it will refuse any access:
Image

### Expected behavior

Not see the specific MFA selection the user has no access to.

### Screenshots

_No response_

### Additional context

_No response_

### Deployment Method

Docker

### Version

2025.12.0-rc2 (clean test-install) + same for 2025.10.3

### Relevant log output

```shell

```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.