Firebase's Auth Export Was Quietly Stripping MFA Enrollment

Firebase CLI v15.22.4, released June 30, 2026, fixes a bug in auth:export and auth:import that was silently dropping mfaInfo data for users enrolled in multi-factor authentication. Teams using the commands to move Firebase Authentication users between projects got no error and no warning. The exported JSON simply didn’t include MFA enrollment, and the re-imported users came back as password-only accounts. The fix is documented in the v15.22.4 release notes on GitHub.

---

Why this was a real risk

auth:export and auth:import are the standard path for moving Firebase Authentication users between projects, per Firebase’s CLI auth docs. Teams use them to consolidate environments, split a monolith project, stand up a staging copy of production, or migrate off Firebase entirely. None of those are edge cases; they’re routine project operations.

A silent drop is worse than a loud failure. If the command had errored, a team would have caught it before the migration finished. Instead, the export completed, the import completed, and the only visible difference was that MFA-enrolled accounts came out the other side accepting a password alone. Any project relying on MFA as a compliance control or a defense against credential-stuffing would have quietly lost that protection for every migrated user, with nothing in the CLI output to flag it.

---

What changed in v15.22.4

• auth:export now includes the mfaInfo field for users who have enrolled a second factor.
• auth:import now reads that field back in, restoring MFA enrollment on the imported account.
• The same release bumps the bundled Pub/Sub emulator to v0.8.34.

No flags or config changes are required. The fix applies automatically to both commands.

---

Key Takeaways

• CLI v15.22.4 (June 30, 2026) fixes auth:export/auth:import dropping mfaInfo for MFA-enrolled users (release notes).
• The bug affected real project-to-project user migrations, not just local emulator testing.
• Migrated accounts silently lost their MFA enrollment and fell back to password-only sign-in, with no error surfaced.
• If you ran a user migration on an earlier CLI version, audit the imported accounts’ MFA status rather than assuming it carried over.

---

The takeaway for teams that already migrated

Anyone who ran auth:export/auth:import between projects on a CLI version older than 15.22.4 should check whether MFA-enrolled users on the destination project still show that enrollment. Firebase’s release notes don’t mention a remediation path for accounts already migrated. Re-enrollment is on the affected users, not something the fix can retroactively restore. Upgrading the CLI prevents the bug going forward; it doesn’t repair a migration that already happened.