If the user did not login by 2fa completely, the cookie still stores the incomplete status. Then if you remove 2fa, the user’s cookie still redirect user to the second factor authentication. You need to remove cookie for your site.
we cannot determine what happened after the 2FA was disabled (and re-enabled).
we did find this in the logs when a user tries to login, but this does not happen when admin logs ins
[Fri Jun 13 06:22:29.894415 2025] [php:error] [pid 382526:tid 382526] [client 192.168.0.4:58646] PHP Fatal error: Allowed memory size of 134217728 bytes exhausted (tried to allocate 4096 bytes) in /srv/www/htdocs/vendor/dflydev/dot-access-data/src/Data.php on line 268, referer: https://domain.ca/login
in log file, this was noted:
2025-06-13T08:16:44.980699-04:00] log.DEBUG: Checking support on authenticator. {“firewall_name”:“main”,“authenticator”:“Symfony\Component\Security\Http\Authenticator\Debug\TraceableAuthenticator”}
[2025-06-13T08:16:44.982480-04:00] log.DEBUG: Checking support on authenticator. {“firewall_name”:“main”,“authenticator”:“Symfony\Component\Security\Http\Authenticator\Debug\TraceableAuthenticator”}
[2025-06-13T08:16:44.983037-04:00] log.DEBUG: Authenticator does not support the request. {“firewall_name”:“main”,“authenticator”:“Symfony\Component\Security\Http\Authenticator\Debug\TraceableAuthenticator”}
also, when logged in as administrator, wasn’t there an option to reset the users 2fa?