TeamViewer Multi-Factor Authentication: Setup, Use and Recovery

TeamViewer offers two separate kinds of two-factor authentication (2FA), and you should turn on both. One protects your TeamViewer account sign-in with a time-based code from an authenticator app. The other protects the computer itself: before a remote session starts, you approve it with a push notification on a phone you registered. This guide explains each one, how to set them up, how to recover when a phone is lost, and one macOS update that administrators need to confirm.

TL;DR

• TeamViewer has two layers: account 2FA (a code from an authenticator app) and 2FA for connections (a push approval on a registered mobile device).
• Connection 2FA needs TeamViewer Classic 15.17 or later on Windows, and 15.22 or later on macOS and Linux.
• On macOS, update Full Client and Host to version 15.80 or later to close CVE-2026-12703, a 2FA bypass in the Unattended Access flow.
• Save your recovery options before you need them. A lost phone is the most common reason people get locked out.
• If you also want a second factor for every other account you own, a password manager with built-in MFA covers the rest.

Two kinds of TeamViewer 2FA, and what each one protects

Most people searching for “TeamViewer MFA” mean one of two things, and the settings are in different places.

Account 2FA protects the sign-in to your TeamViewer account. After your email and password, you enter a one-time code from an authenticator app. TeamViewer’s security technical overview describes it as time-based one-time password (TOTP) protection against unauthorized access to the account.

2FA for connections protects the target computer. Per the same document, a remote session can only be established after someone approves a push notification on a designated mobile device. That matters because the password is no longer enough: even if an attacker holds valid account credentials, they still need the approval device.

TeamViewer announced the connection feature on April 27, 2021. It is optional, can be set up for all remote control connections, and asks you to allow or deny each connection on registered mobile devices.

The practical difference:

If you use TeamViewer to reach a home PC, a client’s server or a family member’s laptop, the connection layer is the one that stops a remote intruder at the door. The account layer stops the intruder from getting a list of your devices in the first place.

Before you start

A few minutes of preparation prevents most of the lockout stories that dominate the forum threads ranking for this topic.

1. A TeamViewer account you can sign in to. Account 2FA is switched on from the account’s security settings, in the Management Console in a browser, as TeamViewer’s own activation page describes.
2. An authenticator app on a phone you control. Any standard TOTP app works for the code. Pick one that can back up or sync its secrets, so a dead phone does not take your codes with it.
3. A supported TeamViewer version for the connection layer. Connection 2FA requires TeamViewer Classic 15.17 or later on Windows and 15.22 or later on macOS and Linux, according to the technical overview and the sources it summarizes.
4. The TeamViewer mobile app on the approval device. Push approvals arrive there.
5. Somewhere safe for recovery information. Write down or store any recovery codes the setup shows you, and keep them off the phone you are protecting.

How to turn on account 2FA

The flow is short, though TeamViewer’s menus change between releases. Follow the on-screen prompts and the vendor’s current instructions if your screen differs.

1. Sign in to the TeamViewer Management Console with your account.
2. Open your profile at the top right and go to your profile or security settings.
3. Find the two-factor authentication option and choose to activate it.
4. Scan the QR code with your authenticator app, or enter the key by hand.
5. Type the six-digit code the app shows to confirm that it works.
6. Store the recovery information you are given.

From then on, signing in asks for your password and the current code. Codes rotate every 30 seconds or so, so type the one on screen at that moment.

Which authenticator apps work

Account 2FA relies on the open TOTP standard, so a standard authenticator app is what you need. Your choice should come down to three things: encrypted backup, the ability to restore on a new phone, and a lock on the app itself. If you manage a lot of logins, a password manager that stores TOTP secrets alongside the credentials keeps everything in one encrypted vault. Our own walkthrough covers setting up TOTP-based 2FA in LogMeOnce, and the same QR-code logic applies when you add TeamViewer.

How to turn on 2FA for connections

This layer takes a bit more thought because it involves a second device and a decision about which connections need approval.

1. Update TeamViewer on the computer you want to protect, to at least the minimum version above. For a Mac, go straight to 15.80 or later (see the next section).
2. Sign in to the TeamViewer account on the computer and on the phone that will approve.
3. In the account’s security settings, enable two-factor authentication for connections and register the mobile device.
4. Make a test connection from another device and confirm the approval prompt arrives on the phone.

When someone connects, TeamViewer sends a push notification to your registered device, and you choose allow or deny. If you did not start the session, deny it and change your TeamViewer password.

Using more than one approval device

A common question, visible in the forum threads that rank for this keyword, is whether a couple or a small team can register several phones. Users in those threads report adding multiple devices to the approval list, but also report glitches with the feature, so test every device after registering it. A good habit: register a primary phone and one backup device such as a tablet kept at home, then run a test with each.

Update macOS now: CVE-2026-12703

If you or your clients use TeamViewer on a Mac, check the version number today.

CVE-2026-12703 is a 2FA bypass in TeamViewer Full Client and Host for macOS before version 15.80. According to the vulnerability record published on July 29, 2026, it rates HIGH (8.0). An attacker who is already authenticated and holds high privileges could get around the “Connections approval” control on the Unattended Access feature and open a full remote session to the Mac. The flaw is a business-logic error in the approval flow.

Heise online reports that the attack only works when 2FA for connections and Unattended Access are both enabled, and the attacker has a valid account with device management rights. SentinelOne’s analysis explains that the connection path did not demand a positive approval before granting control, so the gate behaved as advisory instead of mandatory.

What to do:

• Update every macOS Full Client and Host to 15.80 or later. That is the vendor’s patch, issued under security bulletin TV-2026-1007, as the advisory entry records.
• Until all Macs are updated, that same entry advises disabling Unattended Access on Macs that do not need it, limiting which accounts and devices can start connections through allowlists or trusted-device policies, and enforcing strong credentials and conditional access.
• Keep account 2FA on too. The bypass assumes the attacker already has a valid, privileged account, so protecting that account sign-in is your first line of defense.

The lesson is not that 2FA is unreliable. It is that MFA settings sit on top of software, and software needs updates. Check the version, then check the setting.

Enforcing 2FA across a team

On a personal account, 2FA is your choice. In a business it should not be. Per TeamViewer’s security documentation, 2FA is optional unless an administrator enforces it, and Premium, Corporate and Tensor plans let administrators do so.

For larger deployments, Conditional Access can centrally enforce connection approval policies across devices, groups or environments. TeamViewer pairs strong user authentication with that central policy to support a zero-trust approach, where each connection is verified explicitly before access is granted.

A workable baseline for a small business:

1. Require 2FA for every account with access to customer or server machines.
2. Turn off Unattended Access on any machine that does not need it.
3. Keep an inventory of who can start connections to which devices, and review it when staff leave.
4. Give each person their own account instead of a shared login, so approvals and logs mean something.
5. Store team credentials in a managed vault rather than a spreadsheet. Our team password manager is built for that.

Remote access tools are also where remote work risk concentrates. Our guide to increasing remote work security covers the surrounding habits.

Lost or replaced phone: recovering TeamViewer 2FA

This is the problem behind several of the top-ranking forum threads: a phone is lost, broken or wiped, and the codes went with it.

If you still have the old phone. Do the migration in this order:

1. Sign in with the old phone’s codes while it still works.
2. Deactivate two-factor authentication in the account’s security settings.
3. Activate it again and scan the new QR code on the new phone.
4. Save the new recovery information.

That is the same path TeamViewer’s community moderators suggest for moving 2FA to a different device: deactivate, then activate again. A QR code from the old setup cannot be “exported” in any official way, so a fresh activation is the clean route.

If the old phone is gone. Use the recovery codes you saved at setup if you have them. Without them, you need TeamViewer’s support to verify your identity and reset the account. Use the vendor’s official support pages for this, and be wary of third-party sites offering a “reset” for a fee or asking for your password.

If you use connection approvals. Register the replacement phone as an approval device, and remove the lost one so that a stranger holding it cannot approve anything. Do this before anything else if the phone was stolen and unlocked.

Prevent the lockout next time

• Keep recovery codes in an encrypted vault or a printed copy in a safe place.
• Choose an authenticator that backs up its secrets.
• Register a second approval device for connections.
• Test your recovery path once a year, not for the first time during an emergency.

Can I use MFA without the full TeamViewer app?

Another frequent forum question is whether MFA can be managed without installing the complete TeamViewer program, for example to use the web client. Account 2FA belongs to the account, not to the installed application, so the same authenticator code applies when you sign in to the account through the web console. Connection approvals, on the other hand, arrive on the registered mobile device regardless of how the connecting side starts the session. For the exact behavior of a given web or lightweight client, check TeamViewer’s current support pages.

Our perspective

Remote access tools are a favorite target because one compromised login can open a whole machine. The TeamViewer feature set shows the right idea: a second factor at sign-in, and a separate approval at connection time. It also shows the cost of weak execution, such as the macOS bypass, which only matters because people leave settings half-configured or software out of date.

Our view is that MFA should be easy enough that people keep it on. A code that you must dig out of a drawer is a code people skip. That is why we build around passwordless MFA, so the approval is something you do in seconds with a device you already carry, and why our password manager can hold your TOTP secrets, recovery codes and strong unique passwords in one encrypted place.

For TeamViewer specifically: turn on both layers, update macOS to 15.80 or later, remove unused Unattended Access, and store your recovery information somewhere you can reach when your phone is gone. Then bring the same discipline to every other account, because attackers rarely stop at one tool.

Mike

Extend MFA beyond TeamViewer

TeamViewer 2FA protects one tool. Your email, banking, cloud storage and admin consoles need the same care, and managing a dozen separate authenticator entries gets messy quickly.

LogMeOnce combines a password manager, passwordless MFA and dark web monitoring. Individuals can start on Premium at $0.00 per month, and our paid personal plans start with Professional at $2.50 per month, Ultimate at $3.25 per month and Family at $4.99 per month. For teams, Teams is $4.00 per user per month and Business is $7.99 per user per month. See the full personal pricing and comparison or the business plans to find the fit.

If you want the passwordless route, read how passwordless MFA works in our product, or explore the full range on our resources hub.

FAQ

Is TeamViewer two-factor authentication on by default?

No. Per TeamViewer’s security documentation, 2FA is optional unless an administrator enforces it, which Premium, Corporate and Tensor plans allow. On a personal account you must switch it on yourself. We recommend doing it for both the account and connections.

What is the difference between account 2FA and 2FA for connections?

Account 2FA asks for an authenticator app code when you sign in to your TeamViewer account. Connection 2FA asks for a push approval on a registered mobile device before a remote session starts. The first protects the account, the second protects the computer being accessed.

What should I do if I lost the phone I use for TeamViewer 2FA?

Use your saved recovery codes to sign in, then deactivate and reactivate 2FA with the new phone. If you have no recovery codes, contact TeamViewer support through its official channels to verify your identity. If connection approvals were set up, remove the lost phone from the approval list as soon as you can.

Do I need to update TeamViewer to use connection 2FA?

Yes, the feature has minimum versions: TeamViewer Classic 15.17 on Windows and 15.22 on macOS and Linux. Mac users should go further and install 15.80 or later, which fixes the CVE-2026-12703 bypass in the Unattended Access approval flow.

Can I register more than one phone for approvals?

TeamViewer lets you add devices to the approval list, and users report registering both a phone and a tablet. After adding each one, make a test connection to confirm the prompt arrives. Keeping a second device registered is a good safeguard against a lost phone.

Sources

• TeamViewer Security Technical Overview
• TeamViewer Adds Additional Layer of Security for Incoming Connections (PRNewswire)
• CVE-2026-12703 record (vuln.today)
• EUVD-2026-50360 record (vuln.today)
• TeamViewer: Two-factor authentication bypassable on macOS (heise online)
• CVE-2026-12703: TeamViewer macOS 2FA Bypass Vulnerability (SentinelOne)

Recommended

• Two-Factor Authentication Setup