Bug requiring users to log in and enter 2FA credentials repeatedly

The chatbot is unhelpful, I’m not interested in caling anybody on the phone, and the forum topics have no obvious home for my issue, so I’m posting it here:

There is a bug on the Wyze website, affecting users of the desktop website in both Firefox and Edge Chromium: users need to log in and enter 2FA credentials every single time they visit the website in a new browser session, even when they’ve logged in successfully and clicked “trust this machine” during previous browser sessions.

It’s also, and separately, incredibly frustrating that logging into the website appears to log me into one of two (unstated) web apps, depending on where I am: I have to log in once in order to access my account (and place an order, if I want to do that); I have to log in again, separately, to view my cameras on the website on a the desktop website.

I dove into your thread and spotted the giveaway — Wyze’s web interface isn’t one single site, it’s two separate web-apps under the hood. That “trust this machine” checkbox only applies to one of them, so your 2FA bypass never carries over when you switch contexts (like fetching your order versus viewing cameras). The fix that worked for me was to choose one browser, sign into that specific Wyze app (either the shop or the camera Web View), check “trust this machine,” then bookmark that exact URL and always start there. That keeps your session persistent and avoids repeated 2FA prompts.

The Wyze desktop experience is actually two separate login flows—trust only lasts per Web-app, so always use the same browser entry point for a smooth, single-login experience.

Yup, this workaround appears to resolve the issue (so far, across two browser sessions). Thanks very much!

Nevermind, this workaround doesn’t seem to work 100% of the time.

There is definitely at least one bug on the page that handles MFA login:

Uncaught ReferenceError: browser is not defined
    <anonymous> https://auth.wyze.com/login/mfa/code?sendEmailCodeResult=true:319
code:319:9
    <anonymous> https://auth.wyze.com/login/mfa/code?sendEmailCodeResult=true:319

The code causing the error is here:

<script>
    document.addEventListener("DOMContentLoaded", function () {
      const browserName = document.getElementById("browserName");
      if (navigator.brave) {
        browserName.value = "Brave";
      } else if (navigator.userAgent.includes('Chrome')) {
        browserName.value = "Chrome";
      } else if (navigator.userAgent.includes('Firefox')) {
        browser.value = "Firefox";
      } else if (navigator.userAgent.includes('Edg')) {
        browserName.value = "Edge";
      } else if (navigator.userAgent.includes('Opera')) {
        browserName.value = "Opera";
      } else if (navigator.userAgent.includes('Trident')) {
        browserName.value = "Internet Explorer 11";
      } else if (navigator.userAgent.includes('Safari')) {
        browserName.value = "Safari";
      } else {
        browserName.value = "";
      }
    });
</script> 

More specifically, in Firefox the Error is thrown on this line:

        browser.value = "Firefox";

Note that the rest of this script assigns values to browserName.value, not to browser.value. Nowhere else in the JS that has loaded does the Wyze webapp reference the browser object. browser.value = "Firefox"; appears to be a mistake. It ought to be browserName.value = “Firefox”.

1 Like

Thanks for the detailed information! I’m passing this along to see if I can get someone from the Web development team to look at this.

Welcome to the Forum, @smk267 & @bennettelena09! :wave:

@Crease @smk267 @bennettelena09 Thank you so much for bringing this up. We have brought this up internally, and this ticket is now with the correct team. I don’t have more details to share, but hopefully we’ll get some updates soon.

1 Like

Thank you for taking the time to post here with the update! :+1:

Sure, happy to help. If a developer would like to meet with me for a screenshare, I’d be happy to do that. Feel free to reach out.

They have the source code. I would think that searching for “browserName” would bring up that bad line of code.

The line appears to be in the HTML that they’re serving. I wouldn’t necessarily expect it necessarily to appear in any of their JS.

OK then, search the html code, or whatever it is that’s generating the html.

Edit.

I took a second look; that’s not html. It’s javascript.

This topic was automatically closed 90 days after the last reply. New replies are no longer allowed.