Firebase Auth errorFirebase Auth: auth/email-change-needs-verification

Rather not fix it yourself? App Fix Ticket starts with a fixed-price diagnosis, then a fixed price for the fix before any fix work.

Why Firebase wants a verified email, and the fix

1. 01

   The account has MFA and an unverified email

   “Multi-factor users must always have a verified email.” Firebase, JS SDK auth errors (email-change-needs-verification)

   Firebase requires multi-factor users to have a verified email. Send a verification email and wait for confirmation before retrying.

2. 02

   The new email isn’t verified before the change

   “You can use verifyBeforeUpdateEmail for Web and Android or sendEmailVerification(beforeUpdatingEmail:) for iOS instead.” Google Cloud, Email enumeration protection

   Google’s docs say that with email enumeration protection on, updateEmail() is no longer allowed. Use verifyBeforeUpdateEmail() on the web and Android, so the change applies once the new address is verified.

   import { verifyBeforeUpdateEmail } from 'firebase/auth';
   
   await verifyBeforeUpdateEmail(auth.currentUser!, newEmail);
   // The email changes after the user clicks the link.

3. 03

   Users enroll MFA before verifying email

   “Ensure your app is verifying user emails. MFA requires email verification.” Firebase, Add multi-factor authentication to your web app

   Firebase’s MFA guide says to verify user emails, so require verification before the MFA enrollment screen.

4. 04

   The project is newer than September 15, 2023

   “If you created your project on or after September 15, 2023, email enumeration protection is enabled by default.” Google Cloud, Email enumeration protection

   Also check: email enumeration protection is on by default for projects created on or after that date, which is why updateEmail() code from older tutorials can stop working.

Checked against the vendor’s docs on November 10, 2026: Firebase JS SDK source: auth errors; Google Cloud docs: Email enumeration protection; Firebase docs: Add multi-factor authentication to your web app.

Rather hand it over?

Fixed scope, fixed price, paid upfront. The work happens in writing; no call needed.

• from $450App Fix TicketOne reproducible bug in an existing mobile or web app, diagnosed and fixed.See scope and start
• from $450AI-Built App RescueA Lovable, Bolt or Cursor app checked end to end in 3 days, then its worst problems fixed at a fixed price.No issues worth fixing, no charge. If the Launch Check finds nothing rated medium or higher, Simon refunds the full $450. You keep the report either way. This applies to the first 10 Launch Checks bought after October 30, 2026.See scope and start

Related: Firebase auth/operation-not-allowed · Firebase auth/multi-factor-auth-required · Firebase auth/second-factor-already-in-use · Firebase invalid-verification-code