From 4577e01465383c9f574004bb3961be2e905bee0c Mon Sep 17 00:00:00 2001
From: Jacek Chmielewski <jacek@defguard.net>
Date: Mon, 5 Oct 2026 11:37:42 +0200
Subject: [PATCH] don't silently override totp secret during reenrollment when
 mfa is skipped

---
 .../full/EnrollmentPage/steps/PasswordStep/PasswordStep.tsx     | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/new-ui/src/pages/full/EnrollmentPage/steps/PasswordStep/PasswordStep.tsx b/new-ui/src/pages/full/EnrollmentPage/steps/PasswordStep/PasswordStep.tsx
index fc4be3e95..5a260c464 100644
--- a/new-ui/src/pages/full/EnrollmentPage/steps/PasswordStep/PasswordStep.tsx
+++ b/new-ui/src/pages/full/EnrollmentPage/steps/PasswordStep/PasswordStep.tsx
@@ -77,7 +77,7 @@ export const PasswordStep = () => {
     onSubmit: async ({ value }) => {
       try {
         const { skipMfaChoice, skipMfa } = useEnrollmentStore.getState();
-        if (skipMfaChoice) {
+        if (!skipMfa && skipMfaChoice) {
           const mfaResponse = await startMfa();
           useEnrollmentStore.setState({
             userTotpSecret: mfaResponse.totp_secret,