Clarify 2.5.6 to resolve #2457 (#2480)

OWASP · Dec 19, 2024 · c1cce51 · c1cce51
1 parent c9b698c
commit c1cce51
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/5.0/en/0x11-V2-Authentication.md b/5.0/en/0x11-V2-Authentication.md
@@ -127,7 +127,7 @@ The requirements in this section mostly relate to section [5.1.1.2](https://page
 | **2.5.3** | [DELETED, DUPLICATE OF 2.4.1] | | | | |
 | **2.5.4** | [MOVED TO 14.1.10] | | | | |
 | **2.5.5** | [DELETED, DUPLICATE OF 2.2.3] | | | | |
-| **2.5.6** | [GRAMMAR] Verify that forgotten password, and other recovery paths use a secure recovery mechanism, such as time-based OTP (TOTP) or other soft token, mobile push, or another offline recovery mechanism. | ✓ | ✓ | ✓ | 640 |
+| **2.5.6** | [MODIFIED] Verify that a secure process for resetting a forgotten password is implemented, that does not bypass any enabled multi-factor authentication mechanisms. | ✓ | ✓ | ✓ | 640 |
 | **2.5.7** | [GRAMMAR, LEVEL L2 > L1] Verify that if OTP or other multi-factor authentication factors are lost, that evidence of identity proofing is performed at the same level as during enrollment. | ✓ | ✓ | ✓ | 308 |
 
 ## V2.6 Lookup Secrets