Merge pull request #17245 from craftcms/bugfix/impersonation-and-elevated-session-without-2sv

complete login with user we're impersonating

Author: brandonkelly

CHANGELOG.md

@@ -9,6 +9,7 @@
 - Fixed a bug where Money field condition rules weren’t working within field layouts. ([#17236](https://github.com/craftcms/cms/issues/17236))
 - Fixed a bug where some custom field inputs weren’t getting initialized properly after being lazily-shown via a field layout condition. ([#17239](https://github.com/craftcms/cms/issues/17239))
 - Fixed an error that could occur when attempting to edit a newly-created nested entry within a Matrix field set to the element index view mode. ([#17231](https://github.com/craftcms/cms/pull/17231))
+- Fixed a bug where setting up two-step verification for an impersonated user would result in the original user getting logged back in. ([#17245](https://github.com/craftcms/cms/pull/17245))
 - Fixed styling issues. ([#17237](https://github.com/craftcms/cms/issues/17237))
 
 ## 5.7.5 - 2025-05-06

src/controllers/UsersController.php

@@ -275,7 +275,7 @@ public function actionLogin(): ?Response
         // if we're impersonating, pass the user we're impersonating to the complete method
         $impersonator = $userSession->getImpersonator();
         if ($impersonator !== null) {
-            $user = $impersonator;
+            $user = Craft::$app->getUser()->getIdentity();
         }
 
         return $this->_completeLogin($user, $duration);