Sounds like normal behavior caused by expired user session / login cookie. Just complete the login process.

@dregad there is a changed behavior in 2.26.0.
E. g. first login into https://www.mantisbt.org/bugs
After that, click on the link in the email you got for this note.
Your browser will open a new tab for that, but you will not be logged in in this tab.

IIRC this was different in older versions.

We also experiencing this problem. You can enter whatever you like in the login field or even just click login button with empty field.

Thanks for the pointer @atrol

I performed some quite tedious testing and analysis using git bisect, and indeed I can confirm the problem now. It has been present for quite some time, but I never really noticed or paid attention to it.

The offending commit is MantisBT master ea80bcfb see 0029611

Problem is the new setting for the Cookie SameSite attribute being set to Strict by default (used to be None), so the cookie is not sent for requests originating from a different domain.

@silambu @tanidar
As a workaround for this behavior, you can set $g_cookie_samesite = 'Lax'; in your config_inc.php.
Please note that users may need to log out and log back in, to switch the string cookie's secure attribute to the new value.

@atrol
I initially set this new config to Strict for security purposes, the intention being to provide the strongest possible protection against CSRF attacks.

I see now that this is detrimental to UX in a quite common usage scenario (click link from email), so maybe the default should be set to Lax instead. And of course improve the documentation in Admin Guide, to clearly describe the impact of each value on system behavior.

What do you think ?

@dregad thanks, that worked for us. We using Mantis with Trello as task management so that was very irritant issue.

so maybe the default should be set to Lax instead. And of course improve the documentation in Admin Guide, to clearly describe the impact of each value on system behavior.

@dregad seems to make sense to me

Thanks for your feedback.

@dregad

Thanks for the workaround, It's works for me :)