Duo Admin Invalid Return URI


After updating to WHMCS 8.9.0, logging into the admin area produces an invalid_grant error after completing Duo Two-Factor Authentication:

error: invalid_grant
error_description: invalid redirect URI '/whmcs/admin/dologin.php'


We have created a hotfix for WHMCS 8.9.0 to correct the issue. You can download it at:



Two-Factor Authentication can be temporarily deactivated for your admin user.

Note down the current value in-case you wish to revert the change:

SELECT authmodule, authdata FROM tbladmins WHERE username = 'ADMIN_USERNAME';

Then clear the field values:

UPDATE tbladmins SET authmodule = '', authdata= '' WHERE username = 'ADMIN_USERNAME';

Replace ADMIN_USERNAME with your admin username.