CB

Looks like in verifyPassword two step is already being disabled. Maybe this usage was changed in Joomla?

Confirmed using Joomlas Google authentication plugin.

Notice: Undefined index: secretkey in D:\wamp64\www\dev\plugins\authentication\joomla\joomla.php on line 193
Notice: Undefined index: securitycode in D:\wamp64\www\dev\plugins\twofactorauth\totp\totp.php on line 195
Notice: Undefined index: securitycode in D:\wamp64\www\dev\plugins\twofactorauth\totp\totp.php on line 206
Notice: Undefined index: securitycode in D:\wamp64\www\dev\plugins\twofactorauth\totp\totp.php on line 217

All of the above notices are thrown when this happens.

Joomla 3.2+ has a JUserHelper::verifyPassword function to verify password. Replace current authentication call usage with it.

The secretkey notice is fixed by changing to new API. The 3 securitycode notices appear to be a bug in Joomla it self. Joomla profile save also throws them if you interrupt the redirect. It's due to the securitycode input no longer being output since the authenticator has already been saved. We can probably workaround it in CBs saving of authenticator settings by skipping the save process if no secret key is in the postdata.