From a3c0d06c1317fbea7e819de1bd3bad4d2419d577 Mon Sep 17 00:00:00 2001
From: Tamal Chakraborty <134912393+Tamalckb531@users.noreply.github.com>
Date: Mon, 1 Dec 2025 23:53:39 +0600
Subject: [PATCH] fix: encode JWT in 2FA redirect URL to prevent invalid header
 error (#25331)

Co-authored-by: Pallav <90088723+Pallava-Joshi@users.noreply.github.com>
---
 packages/features/auth/lib/next-auth-options.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/packages/features/auth/lib/next-auth-options.ts b/packages/features/auth/lib/next-auth-options.ts
index fedc3e958a..774b88e59b 100644
--- a/packages/features/auth/lib/next-auth-options.ts
+++ b/packages/features/auth/lib/next-auth-options.ts
@@ -97,7 +97,7 @@ const usernameSlug = (username: string) => `${slugify(username)}-${randomString(
 const getDomainFromEmail = (email: string): string => email.split("@")[1];
 
 const loginWithTotp = async (email: string) =>
-  `/auth/login?totp=${await (await import("./signJwt")).default({ email })}`;
+  `/auth/login?totp=${encodeURIComponent(await (await import("./signJwt")).default({ email }))}`;
 
 type UserTeams = {
   teams: (Membership & {