From 85115ca81e2dea25126981e4b107fac21ca6ef4f Mon Sep 17 00:00:00 2001
From: Jacob Dreesen <j.dreesen@neusta.de>
Date: Mon, 9 Feb 2026 12:21:01 +0100
Subject: [PATCH 1/3] Update 2FA form to use text input for code

---
 templates/admin/login/two_factor_authentication.html.twig | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/templates/admin/login/two_factor_authentication.html.twig b/templates/admin/login/two_factor_authentication.html.twig
index a441cab67..ef7220410 100644
--- a/templates/admin/login/two_factor_authentication.html.twig
+++ b/templates/admin/login/two_factor_authentication.html.twig
@@ -11,8 +11,8 @@
         </div>
     {% endif %}
 
-    <form method="post" action="{{ path('pimcore_admin_2fa_verify') }}">
-        <input name="_auth_code" id="_auth_code" autocomplete="one-time-code" type="password" placeholder="{{ '2fa_code'|trans([],'admin') }}" required autofocus>
+    <form method="post" action="{{ path('pimcore_admin_2fa_verify') }}" autocomplete="off">
+        <input name="_auth_code" id="_auth_code" autocomplete="one-time-code" type="text" inputmode="numeric" placeholder="{{ '2fa_code'|trans([],'admin') }}" required autofocus>
         <input type="hidden" name="csrfToken" value="{{ pimcore_csrf.getCsrfToken(app.request.session) }}">
 
         <button type="submit">{{ 'Login'|trans([],'admin') }}</button>

From 5baa65ab9fd3394d0dd566e3f92743a0028a6a97 Mon Sep 17 00:00:00 2001
From: Jacob Dreesen <j.dreesen@neusta.de>
Date: Mon, 9 Feb 2026 12:28:59 +0100
Subject: [PATCH 2/3] Update two-factor setup form

---
 templates/admin/login/two_factor_setup.html.twig | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/templates/admin/login/two_factor_setup.html.twig b/templates/admin/login/two_factor_setup.html.twig
index bf2b87280..ca7c80ac0 100644
--- a/templates/admin/login/two_factor_setup.html.twig
+++ b/templates/admin/login/two_factor_setup.html.twig
@@ -16,8 +16,8 @@
         <p>{{ '2fa_alert_text'|trans([], 'admin')|raw }}</p>
     </div>
 
-    <form method="post" action="{{ path('pimcore_admin_2fa_setup') }}">
-        <input name="_auth_code" id="_auth_code" autocomplete="one-time-code" type="password" placeholder="{{ '2fa_code'|trans([],'admin') }}" required autofocus>
+    <form method="post" action="{{ path('pimcore_admin_2fa_setup') }}" autocomplete="off">
+        <input name="_auth_code" id="_auth_code" autocomplete="one-time-code" type="text" inputmode="numeric" placeholder="{{ '2fa_code'|trans([],'admin') }}" required autofocus>
         <input type="hidden" name="csrfToken" value="{{ pimcore_csrf.getCsrfToken(app.request.session) }}">
 
         <button type="submit">{{ 'Login'|trans([],'admin') }}</button>

From 1c6ec3bc1144347e563b3bad5f1f072b64cb14bc Mon Sep 17 00:00:00 2001
From: Jacob Dreesen <j.dreesen@neusta.de>
Date: Mon, 9 Feb 2026 12:31:57 +0100
Subject: [PATCH 3/3] Remove `autocomplete="off"` again

---
 templates/admin/login/two_factor_authentication.html.twig | 2 +-
 templates/admin/login/two_factor_setup.html.twig          | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/templates/admin/login/two_factor_authentication.html.twig b/templates/admin/login/two_factor_authentication.html.twig
index ef7220410..80a52e7f5 100644
--- a/templates/admin/login/two_factor_authentication.html.twig
+++ b/templates/admin/login/two_factor_authentication.html.twig
@@ -11,7 +11,7 @@
         </div>
     {% endif %}
 
-    <form method="post" action="{{ path('pimcore_admin_2fa_verify') }}" autocomplete="off">
+    <form method="post" action="{{ path('pimcore_admin_2fa_verify') }}">
         <input name="_auth_code" id="_auth_code" autocomplete="one-time-code" type="text" inputmode="numeric" placeholder="{{ '2fa_code'|trans([],'admin') }}" required autofocus>
         <input type="hidden" name="csrfToken" value="{{ pimcore_csrf.getCsrfToken(app.request.session) }}">
 
diff --git a/templates/admin/login/two_factor_setup.html.twig b/templates/admin/login/two_factor_setup.html.twig
index ca7c80ac0..d36ea1a37 100644
--- a/templates/admin/login/two_factor_setup.html.twig
+++ b/templates/admin/login/two_factor_setup.html.twig
@@ -16,7 +16,7 @@
         <p>{{ '2fa_alert_text'|trans([], 'admin')|raw }}</p>
     </div>
 
-    <form method="post" action="{{ path('pimcore_admin_2fa_setup') }}" autocomplete="off">
+    <form method="post" action="{{ path('pimcore_admin_2fa_setup') }}">
         <input name="_auth_code" id="_auth_code" autocomplete="one-time-code" type="text" inputmode="numeric" placeholder="{{ '2fa_code'|trans([],'admin') }}" required autofocus>
         <input type="hidden" name="csrfToken" value="{{ pimcore_csrf.getCsrfToken(app.request.session) }}">