HOTP codes are identical for all users

[HappyRoot]

Hello,

HOTP generation uses constant values from IdServerEmailOptions (shared key/counter), producing the same OTP for every user.
Possible solution: generate and store a unique salt per user, and retrieve the counter from the database?

[simpleidserver]

Hello :)

Sometimes, the HOTP and TOTP are stored in the OPTIONS because they are used in the following scenarios:

• ** Sending a link via email or SMS to reset a password.**
• ** Sending a code via email or SMS to register a user.**

Both processes are executed only once and do not pose a security risk.

Unique TOTP and HOTP codes are used during authentication.