2FA Authentication TOTP unstable is KeePassXC extension.

[Alexandr1322]

Describe the bug
2FA Authentication TOTP unstable is KeePassXC extension.

To Reproduce
Steps to reproduce the behavior:

1. Go to '...'
2. Click on '....'
3. Scroll down to '....'
4. See error

Expected behavior
A clear and concise description of what you expected to happen.

Screenshots
If applicable, add screenshots to help explain your problem.

Info (please complete the following information):

• Server OS: Ubuntu 24.04.4 LTS
• Server Arch: x86_64
• Nginx UI Version: 2.5.6 (543)
• Firefox 150.0

Additional context
When logging into the panel, the first three attempts work perfectly, but then strange problems with recognizing the TOTP code entry fields begin. The fields stop being recognized.

[0xJacky]

Thanks for the report. The TOTP step in NGINX UI uses six segmented input fields that are mounted dynamically after the username/password step. KeePassXC-Browser normally supports segmented TOTP fields, but the current information is not enough to determine why field detection stops after a few attempts.

Could you please provide the following details?

1. Your KeePassXC version and KeePassXC-Browser extension version.
2. The exact sequence that reproduces the problem. Does "the first three attempts" mean three complete login/logout cycles, three invalid TOTP submissions, or three autofill actions?
3. When KeePassXC stops recognizing the fields, can you still enter the current TOTP manually and log in successfully?
4. Does reloading the page or restarting the browser extension restore field detection?
5. If possible, a screenshot or screen recording and the KeePassXC-Browser debug log from the failed state. Please redact usernames, URLs, secrets, and TOTP values.

These details will help us distinguish a dynamic frontend field-detection issue from a server-side TOTP validation issue.

[Alexandr1322]

KeePassXC 2.7.12 | KeePassXC-Browser: 1.10.3

This is the entrance to the panel and after editing the configuration, actions inside the panel over time.
Data is entered manually and changes are applied.
Refreshing the page doesn't help.
I think this is most likely an extension bug, but I would like to understand why this happens after some time.

[Alexandr1322]

It would be better if there was an option to set up Passkey, just as a suggestion.

[0xJacky]

Thanks for the clarification. This behavior likely lines up with NGINX UI's secure 2FA session lifetime.

After a successful TOTP verification, NGINX UI creates a secure session that is valid for 10 minutes. Protected operations, including configuration changes, reuse that session during this period. Once it expires, NGINX UI dynamically mounts a new 2FA prompt inside a modal. The initial login form and this later modal use the same segmented TOTP component, but they have different DOM and lifecycle contexts.

Since manual TOTP entry still works and the changes are applied, the server-side TOTP validation appears to be functioning correctly. The likely compatibility issue is that KeePassXC-Browser does not reliably rediscover the six dynamically mounted TOTP fields in the modal. Refreshing the page does not renew the expired secure session, so the modal is used again on the next protected operation.

Could you confirm whether the recognition problem starts roughly 10 minutes after the last successful TOTP verification? That would help verify this sequence.

Passkey support is already available in NGINX UI 2.5.6 under User Profile -> 2FA Settings -> Add a passkey. WebAuthn must first be configured in app.ini, and HTTPS is required unless NGINX UI is accessed through localhost. Once registered, a passkey can be used both for signing in and for approving these secure-session prompts.

We will continue investigating the field-detection compatibility of the dynamically mounted modal.

[Alexandr1322]

That's right, 10 minutes. And that's it.