Hi!
I don't understand the problem.

Is it about a normal user beeing able to delete another ones 2FA from the normal account-console? - I tried to replicate it:

1. Registered 2 Test-Users - both with TOTP enabled
2. Get the ID of the TOTP credentials of User 1 (sniffing the REST-API while looking at the Credentials-Tab)
3. Log in as User 2
4. Delete the own credentials to see how the request should look like
5. re-enable OTP for User 2
6. resend the old request using curl, but replace the uuid in the path to the uuid of the OTP credentials of user 1 (and use fresh access_token if expired)

I got a proper {"error":"Credential not found"}. That was with Keycloak 15.0.2.

Or do you mean from the admin-console? A Admin does have all permissions, so I guess that is wanted behaviour. If this would be disabled, a admin could still eg. press the Impersonation-Button and reset the credentials there.

God bless!
Thomas

@Hashan1100 hi, this is not the correct place to report suspected vulnerabilities, please disclose such issues in a responsible way. For more details look at the security policy attached here, which you can also find on our website.