2fa/MFA code invalid

[msrv]

Describe the Bug

Hi all,
I might have discovered a bug in v25.12.8

I am unable to enable the multi factor authentication. The qr code is displayed correctly & i can generate a one time code with my totp app (1password). However, the code is "invalid" and does not work.

Timezone settings on the server and my computer are the same.

Error log does not log any errors even if set to APP_DEBUG=true

I would be glad if anyone could help :) thank you!

Steps to Reproduce

1. enable 2fa
2. scan qr / enter totp secret
3. enter the generated code
4. code is invalid

Expected Behaviour

code should be valid

Screenshots or Additional Context

i run bookstack on ubuntu 24.04.4 LTS, Apache 2.4.58, PHP 8.3.6

Browser Details

No response

Exact BookStack Version

BookStack v25.12.8

[ssddanbrown]

Hi @msrv,

I'm not sure why this would be other that a timing issue, so I'm going to dig into that first just to rule it out.

• Do you have any timezone options set in your BookStack env file?
• What timezone is set for the host system?
• Is 1Password running on the system you're accessing BookStack from, or another device?
• Do you know how BookStack was installed on this system?
• On the host machine, can you run the below and confirm the output?:

echo "=== BASH TIME & TIMEZONE INFO ===" && \
echo "Local Time:    $(date)" && \
echo "UTC Time:      $(date -u)" && \
echo "Unix Time:     $(date +%s)" && \
echo "Timezone:      $(timedatectl show --property=Timezone --value 2>/dev/null || cat /etc/timezone 2>/dev/null || date +%Z)" && \
echo "TZ Offset:     $(date +%z)" && \
echo "TZ Abbrev:     $(date +%Z)" && \
echo "" && \
echo "=== PHP TIME & TIMEZONE INFO ===" && \
php -r "
\$tz = date_default_timezone_get();
echo 'Local Time:    ' . date('D M d H:i:s T Y') . PHP_EOL;
echo 'UTC Time:      ' . gmdate('D M d H:i:s') . ' UTC ' . gmdate('Y') . PHP_EOL;
echo 'Unix Time:     ' . time() . PHP_EOL;
echo 'Timezone:      ' . \$tz . PHP_EOL;
echo 'TZ Offset:     ' . date('P') . PHP_EOL;
echo 'TZ Abbrev:     ' . date('T') . PHP_EOL;
"