BUG: RoboForm Integration failing at 2FA (BadMultiFactorException) on latest RDM 2026.2.13.0
Hello,
We are experiencing a broken integration with RoboForm in the latest version of RDM. Our administrators are unable to open the RoboForm Vault within RDM because the 2FA (OTP via email) authentication fails completely. The OTP emails are never generated or sent by RoboForm when requested via RDM.
Environment:
Troubleshooting done so far: We opened a ticket with RoboForm Support regarding the missing OTP emails. Their response points directly to an outdated protocol being used by the application initiating the request (RDM):
"It appears that the RoboForm application on the device you are remoting into is very old and the 2FA is being rejected due to its out of date 2FA protocol."
Since our local RoboForm client is fully up to date, it indicates that the PasswordManagerAccess library built into RDM is using a deprecated API call (ScramSequence) that RoboForm servers now actively reject at the OTP validation step.
Error Log from RDM:
Plaintext
PasswordManagerAccess.Common.BadMultiFactorException: Invalid second factor code
at PasswordManagerAccess.RoboForm.Client.Step2(Credentials credentials, OtpOptions otp, AuthInfo authInfo, RestClient rest)
at PasswordManagerAccess.RoboForm.Client.PerformScramSequence(Credentials credentials, OtpOptions otp, RestClient rest)
at PasswordManagerAccess.RoboForm.Client.Login(Credentials credentials, Ui ui, RestClient rest)
at PasswordManagerAccess.RoboForm.Client.Login(ClientInfo clientInfo, Ui ui, RestClient rest)
at PasswordManagerAccess.RoboForm.Client.OpenVault(ClientInfo clientInfo, Ui ui, IRestTransport transport)
Could your engineering team verify if the RoboForm integration module needs an update to support their current 2FA implementation? Currently, our only workaround is to disable 2FA on the RoboForm account, which is a major security compromise for our infrastructure.
Thank you in advance for your help.
Hello,
We've received another report of this issue. We have a ticket opened and will contact the developer in charge of the library we use.
Regards,
Hubert Mireault