---
title: "Breaking: #92801 - Removed \"Failed Login\" functionality from User Authentication object"
manual: "TYPO3 Core Changelog"
version: "main"
permalink: "https://docs.typo3.org/permalink/changelog:breaking-92801"
source: "Changelog/11.0/Breaking-92801-RemovedFailedLoginFunctionalityFromUserAuthenticationObject.rst"
typo3-version: "11.0"
typo3-major: 11
type: "breaking"
issue: 92801
forge: "https://forge.typo3.org/issues/92801"
tags: ["Backend", "PHP-API", "FullyScanned", "ext:core"]
rendered: "2026-09-20T18:31:11+00:00"
---

# Breaking: #92801 - Removed "Failed Login" functionality from User Authentication object {#breaking-92801}

See [forge#92801](https://forge.typo3.org/issues/92801)

## Description {#description}

The functionality to send an email to a defined sender was previously hard-coded
into the API class `AbstractUserAuthentication` and activated specifically for
Backend Users via the option `$GLOBALS['TYPO3_CONF_VARS']['BE']['warning_email_addr']`.

With some custom implementation it was also possible to use a hook to
enable this for frontend users, but the API was not clean.

The backend-user specific logic is now extracted into a hook, so it is possible
to replace this functionality with a custom notification API.

For this reason, the following public properties and methods within
`AbstractUserAuthentication` and its subclasses have been removed:

-   `TYPO3\CMS\Core\Authentication\AbstractUserAuthentication->warningEmail`
-   `TYPO3\CMS\Core\Authentication\AbstractUserAuthentication->warningPeriod`
-   `TYPO3\CMS\Core\Authentication\AbstractUserAuthentication->warningMax`
-   `TYPO3\CMS\Core\Authentication\AbstractUserAuthentication->checkLogFailures()`

## Impact {#impact}

Using one of the public properties in custom PHP will trigger a PHP Warning.

Calling the public PHP method will result in a fatal PHP error.

## Affected Installations {#affected-installations}

TYPO3 installations with third-party extensions and custom PHP code that is
related to failed login notifications, and rely on the existing login
notification code.

## Migration {#migration}

As the properties were public, they made it possible to override the
warningMax / warningPeriod values via hooks and middlewares in PHP.

Instead it is recommended to override this functionality via a hook the same way
the new hook in EXT:backend is registered within PHP.