GitHub forced a password reset after reporting a suspicious login

[kawishkamd]

🏷️ Discussion Type

Question

💬 Feature/Topic Area

Other

Body

GitHub unexpectedly logged me out, and when I tried to sign in, my password no longer worked. At the same time, I received an email from GitHub stating that it had detected a "suspicious login" and had forced a password reset as a precaution.

Some details:

• 2FA was already enabled.
• The password was unique, randomly generated, and not reused elsewhere.
• My security log only shows my own successful login after resetting the password.
• I don't see any unfamiliar logins, email changes, SSH keys, passkeys, or repository changes.
• About 10 hours before I noticed the issue, GitHub automatically revoked all of my OAuth authorizations and access tokens with the explanation password_randomized.

Has anyone experienced something similar? If so, were you able to determine what triggered GitHub's automated security response, or did GitHub Support provide any additional context?

[anishko]

If GitHub detects something that looks risky, it can force a password reset even if 2FA is enabled. Support usually won't share the exact reason for security reasons. If your security log and account settings all look normal after resetting your password, I think it's very likely that the automated systems were just being cautious.

[kawishkamd]

Thanks! I think so too. After checking everything, I haven't found any evidence of unauthorized access, so it seems like GitHub's automated security systems were just being cautious.