2024 Audit - SEC-01-010 WP4: Missing 2FA Enforcement for Sensitive Operations

[zenmonkeykstop]

The SecureDrop Journalist application permits users to configure two-factor
authentication, but it is not enforced for various security-sensitive admin operations. If an
admin password and session token are leaked, an attacker could alter passwords or
disable MFA for registered users without an MFA code. This issue is not a vulnerability
but a hardening recommendation to strengthen authentication security.

We will be investigating this further as part of ongoing work on MFA improvements.