Steps to reproduce the issue

Audit finding

When selecting an MFA method, users are presented with links such as Backup Codes, Code by Email, and Passkey.

Each link contains:

• The visible method name
• An image representing the method, with alt text matching the method name
• Hint text that repeats the method name

Because all three are inside the link, the accessible name repeats. For example, the report identifies “My Passkey Passkey Passkey” and “Code by Email Code by Email Code by Email”.

The report recommends making the image alt text empty and removing the duplicated hint text, so the link name is announced once.

User impact

Screen-reader users hear the same method name repeated multiple times when navigating normally or using a links list.

The repeated wording makes the MFA method list harder to scan and can be disorienting, particularly during sign-in when users need to choose a method quickly.

The verbose accessible names also make the links list less useful for navigation.

Remediation plan

Provide one concise accessible name for each MFA method link

• Ensure each MFA method link has one concise, meaningful accessible name
• Set the method image alt attribute to an empty string when the adjacent visible text already identifies the method
• Remove hint text that duplicates the method name from the link's accessible name
• Preserve any genuinely additional hint text outside the accessible name only if it provides new information
• Ensure the visible method name remains the accessible name
• Ensure the accessible name contains the visible label text
• Apply the pattern consistently across front-end and back-end MFA method selection
• Ensure the change works for all installed MFA methods, including third-party methods where applicable
• Do not remove information needed to distinguish methods
• Verify the accessible name in normal reading mode and links-list mode

Preconditions

• Use Joomla 6.2 with Atum in the administrator interface and Cassiopeia on the front end
• Create or use a test account with at least two MFA methods configured
• Use a test installation where the MFA captive view can be reached without affecting a production account
• Record the exact Joomla build, browser name and version, operating system, viewport dimensions, and browser zoom
• Record the screen reader and browser combination if testing announcements
• Start at 100% browser zoom
• Record the active appearance and any template overrides or custom CSS
• Record the configured MFA methods before testing

Steps to reproduce

1. Open the Joomla front-end or administrator sign-in flow for the test account
2. Complete the initial sign-in step
3. Open the MFA captive view that asks the user to select an MFA method
4. Inspect each method link using Developer Tools
5. Record the visible method name, image alt attribute, and any hint text
6. Record the link's computed accessible name
7. Check whether the method name is repeated in the accessible name
8. Move keyboard focus to each link
9. Record the screen-reader announcement
10. Open the screen reader's links list
11. Record the names shown for the MFA method links
12. Repeat for both the front-end and back-end MFA flows
13. Capture the method list, link accessible names, and screen-reader announcements

Screen-reader verification

1. Use a screen reader with the browser combination being tested
2. Navigate through the MFA method links
3. Record the announced accessible name for each link
4. Check whether the method name is repeated
5. Open the links list and record the link names
6. Confirm that each method can still be distinguished
7. Repeat with at least one additional screen reader if available
8. Record the screen-reader name, version, browser, and operating system

Verification after remediation

1. Open the MFA method-selection view
2. Confirm that each method link has one concise accessible name
3. Confirm that the image alt attribute is empty when the visible text identifies the method
4. Confirm that duplicated hint text no longer contributes to the accessible name
5. Confirm that the accessible name contains the visible method label
6. Confirm that each method remains distinguishable
7. Repeat for the front-end and back-end MFA flows
8. Record the final accessible names and screen-reader announcements

Version

6.2

Expected result

Each MFA method link has a concise accessible name that identifies the method once.

The method image does not duplicate the visible method name, and duplicated hint text does not contribute to the accessible name.

Screen-reader users can scan and distinguish the available MFA methods in normal reading mode and links-list mode.

Actual result

The MFA method links repeat the method name in their accessible names.

The image alt text and hint text duplicate the visible method name inside each link.

For example, the report identifies accessible names such as “My Passkey Passkey Passkey” and “Code by Email Code by Email Code by Email”.

The current Joomla 6.2 build needs to be checked to establish whether the issue persists and which MFA methods are affected.

What device were you using? (eg, phone, laptop)

Desktop web

What web browser were you using? (eg, Chrome, Safari)

Chrome, Firefox, Edge, Safari

Assistive Technology?

VoiceOver, JAWS, NVDA

Additional Comments

The browser and assistive-technology entries above are carried forward from the original issue and do not represent a new verification of every combination against Joomla 6.2.

Development is the responsibility tag in the original report.

The report also notes that the helper text did not meet contrast requirements. Because the recommended fix removes that duplicated text, this issue focuses on the accessible name; contrast should be checked separately if equivalent helper text is retained.

This issue concerns the accessible names of MFA method-selection links. It is distinct from #48373, which concerns the missing alternative text for the MFA setup QR code.

MS2b is proposed for the shared MFA method-selection component, with MS3b covering the documented Atum and Cassiopeia integrations.