{"record":{"id":"7090ee8be9f1971e","repo":"apereo/cas","slug":"failed-to-authenticate-code-7090ee","errorCode":null,"errorMessage":"Failed to authenticate code ","messagePattern":"Failed to authenticate code ","errorType":"exception","errorClass":"FailedLoginException","httpStatus":null,"severity":"error","filePath":"support/cas-server-support-gauth-core/src/main/java/org/apereo/cas/gauth/web/flow/GoogleAuthenticatorValidateTokenAction.java","lineNumber":53,"sourceCode":"    @Override\n    protected @Nullable Event doExecuteInternal(final RequestContext requestContext) throws Throwable {\n        val token = requestContext.getRequestParameters().getRequired(GoogleAuthenticatorSaveRegistrationAction.REQUEST_PARAMETER_TOKEN, String.class);\n        val accountId = requestContext.getRequestParameters().getRequired(OneTimeTokenAccountConfirmSelectionRegistrationAction.REQUEST_PARAMETER_ACCOUNT_ID, Long.class);\n\n        val authentication = WebUtils.getAuthentication(requestContext);\n        val tokenCredential = new GoogleAuthenticatorTokenCredential(token, accountId);\n        val validatedToken = validator.validate(authentication, tokenCredential);\n        if (validatedToken != null) {\n            val principal = authentication.getPrincipal().getId();\n            LOGGER.debug(\"Validated OTP token [{}] successfully for [{}]\", validatedToken, principal);\n            val validate = requestContext.getRequestParameters().getBoolean(OneTimeTokenAccountSaveRegistrationAction.REQUEST_PARAMETER_VALIDATE);\n            if (validate == null || !validate) {\n                validator.store(validatedToken);\n            }\n            return success();\n        }\n        LOGGER.warn(\"Authorization of OTP token [{}] has failed for [{}]\", token, authentication.getPrincipal().getId());\n        throw new FailedLoginException(\"Failed to authenticate code \" + token);\n    }\n}\n","sourceCodeStart":35,"sourceCodeEnd":56,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-gauth-core/src/main/java/org/apereo/cas/gauth/web/flow/GoogleAuthenticatorValidateTokenAction.java#L35-L56","documentation":"GoogleAuthenticatorValidateTokenAction validates the OTP during login and throws FailedLoginException 'Failed to authenticate code <token>' when validator.validate returns null — the token did not authorize against any registered account. Unlike the handler, when validation succeeds it stores the token only if configured (validate flag false means the token wasn't yet consumed upstream).","triggerScenarios":"doExecuteInternal calls validator.validate(tokenCredential, authentication) during the mfa-gauth webflow; a null result (invalid code, reused token, account not found, clock drift, accountId mismatch with multiple registered accounts) triggers the FailedLoginException.","commonSituations":"User enters an expired or already-used TOTP; secret mismatch after re-registration; server clock skew; user with multiple registered devices supplying a code without the matching accountId; login page resubmission replaying an old code.","solutions":["Enter a newly generated code from the correct authenticator entry and retry","Ensure NTP/time sync on the CAS server to keep TOTP windows aligned","If several devices are registered, verify the accountId selection matches the device used","Check the mfa-gauth webflow properties: whether validate/store behavior marks tokens consumed consistently across nodes"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"if (!/^\\d{6}$/.test(token) && !/^\\d{8}$/.test(token)) return error(\"Enter a valid 6- or 8-digit code\");","typeGuard":null,"tryCatchPattern":"try {\n    validateTokenAction.executeInternal(rc);\n} catch (FailedLoginException e) {\n    return retryOtpPrompt(\"Invalid code — request a new one\");\n}","preventionTips":["NTP-sync all CAS nodes","Share the GAuth token repository in clusters so consumption is consistent","When multiple devices are registered, pass the matching accountId","Prevent login-page resubmission that replays consumed codes"],"tags":["gauth","otp","webflow","mfa"],"backgroundTag":"authentication-failed","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}