goauthentik / goauthentik/authentik
Generated recovery link doesn't bypass email stage
- Dominant language
- Python
- Stars
- 25.6k
- Forks
- 2k
- Avg merge
- 1d 1h
- Merged PRs (30d)
- 644
Description
**Describe the bug**
A recovery link generated for a user by an admin does not bypass email stage. Therefore the user then has to enter an email address, wait for that mail and restart the recovery process with the included link.
**To Reproduce**
Steps to reproduce the behavior:
1. Open user list in admin UI
2. Generate a recovery link or send a recovery mail for any user
3. The link is generated / mail is sent successfully, navigate to the recovery url
4. Email stage is shown and waiting for user input of an email address
**Expected behavior**
The email stage should be bypassed and the password prompt stage should be shown.
**Version and Deployment (please complete the following information):**
- authentik version: 2024.4.2
- Deployment: docker
**Additional context**
Tokens are generated correctly and were still valid when the recovery link was used.
The flow works correctly when the user requests a recovery link via "forgot password" and navigates to the url in the received mail.
**Possibly related bugs**
- https://github.com/goauthentik/authentik/issues/9671
- https://github.com/goauthentik/authentik/issues/2749
Contributor guide
Assessment
This issue has not been assessed yet.