Disabling 2FA should ask for the Code once again

[dionysius]

Currently when disabling the 2FA on client side there is no step asking for the code a last time -> it directly disables. So for disabling 2FA only a valid session required. I think that this is not enough. Disabling the 2FA should be the same security as like the normal login.

Should disabling the 2FA need the a valid Code for confirmation? Discussion open :)

[cenourinha]

Yes, it should ask for a 2FA validation or to insert the actual password.

[pcdog]

I'd agree on that too.

[DewlanceHosting]

What if Mobile is stolen and you are using backup code to access your account?

It will ask for code to disable it then how you will provide code?

However I am agree that it should ask for whmcs admin password.