Could not disable 2FA
Turning off Google Authenticator from Account → Settings failed. Fallback product text when the disable API does not return a clearer error.
Why this happens
POST /api/account/2fa/disable requires a valid session, CSRF header, and the account password. Common failures: wrong password, expired session, CSRF not ready, or 2FA is mandatory on the site (members cannot disable — you see a mandatory message instead when the UI gates it).
Diagnose and fix
1. Re-enter the current account password carefully; try again after a hard refresh.
2. Confirm cookies work and the CSRF token loaded (same family as Could not load security token — refresh the page).
3. Admin: Settings → Security → Two-factor authentication mode — if mandatory, members cannot turn 2FA off; staff can use Reset user 2FA / sessions.
4. Distinct from Could not turn on authenticator (enable path) and setup-start failures.