Zitadel admin 2FA prompt when trying to log in

🏬Self-hosted🪵Login🪲Bugs✅Solved

Hello guys

Hi ZITADEL team,

we ran into an issue on our self-hosted instance and I’d like to understand what may have happened.

We are running ZITADEL in a self-hosted setup.

We suddenly got prompted for 2FA on the default ZITADEL instance/org when logging in with the default admin account.

To recover access, we manually updated the database and changed:

projections.login_policies%.second_factorsprojections.login_policies%.second_factors

to {2}{2} on the default ZITADEL instance/org, after which we were able to log in again.

A few questions:

What could have caused this 2FA requirement to become active unexpectedly?
Is there any known path where org or instance login policy can inherit or switch MFA settings without an explicit admin action?
Are there specific tables, events, or logs we should inspect to understand who or what changed the login policy?
Is manually changing projections.login_policies% known to be unsafe here, and if so, what would be the correct emergency recovery procedure for self-hosted setups when all admins are locked out?

We would mainly like to understand the root cause and the recommended recovery path for this situation.

Thanks.