Describe the bug
Subject: Bug Report: Email Verification Always Returns 'Invalid Verification Code'
Hi 2Stable Support Team,
I'm experiencing a bug with the email verification flow in the Open Authenticator app that makes it impossible to verify any email address.
What happens:
After entering an email address in the Open Authenticator form, I receive a confirmation email containing a verification link. Clicking the link immediately returns the following error:
{"success":false,"data":{"errorCode":"invalidVerificationCode","message":"Invalid verification code."}}
The verification email does not contain a standalone verification code — however, the confirmation link itself contains what appears to be the code as a URL parameter, e.g.:
https://backend.openauthenticator.app/auth/provider/email/callback?verificationCode=XIEOFH&email=abc.def@gmail.com
Entering the code manually (e.g. "XIEOFH") in the app's alternative verification field produces an error too.
Reproducibility:
The issue is fully reproducible and independent of:
- Email address (tested with two different addresses)
- Device (tested on iOS and macOS)
- Browser (tested on Firefox and Chrome)
In all combinations, the result is identical: the verification code — whether clicked via link or entered manually — is rejected by the server as invalid.
Expected behavior:
Clicking the verification link (or entering the code manually) should successfully verify the email address and complete the login flow.
Actual behavior:
The server returns {"errorCode":"invalidVerificationCode"} in all cases, making email-based login completely non-functional.
This appears to be a server-side issue, as the code is generated and delivered by your backend but then not accepted by the same backend upon submission.
Please let me know if you need any additional information or logs.
Best regards,
R Kalasek
Describe the bug
Subject: Bug Report: Email Verification Always Returns 'Invalid Verification Code'
Hi 2Stable Support Team,
I'm experiencing a bug with the email verification flow in the Open Authenticator app that makes it impossible to verify any email address.
What happens:
After entering an email address in the Open Authenticator form, I receive a confirmation email containing a verification link. Clicking the link immediately returns the following error:
{"success":false,"data":{"errorCode":"invalidVerificationCode","message":"Invalid verification code."}}
The verification email does not contain a standalone verification code — however, the confirmation link itself contains what appears to be the code as a URL parameter, e.g.:
https://backend.openauthenticator.app/auth/provider/email/callback?verificationCode=XIEOFH&email=abc.def@gmail.com
Entering the code manually (e.g. "XIEOFH") in the app's alternative verification field produces an error too.
Reproducibility:
The issue is fully reproducible and independent of:
In all combinations, the result is identical: the verification code — whether clicked via link or entered manually — is rejected by the server as invalid.
Expected behavior:
Clicking the verification link (or entering the code manually) should successfully verify the email address and complete the login flow.
Actual behavior:
The server returns {"errorCode":"invalidVerificationCode"} in all cases, making email-based login completely non-functional.
This appears to be a server-side issue, as the code is generated and delivered by your backend but then not accepted by the same backend upon submission.
Please let me know if you need any additional information or logs.
Best regards,
R Kalasek