diff --git a/apps/browser/src/auth/popup/two-factor.component.html b/apps/browser/src/auth/popup/two-factor.component.html
index 7fec67378c..d03c675abd 100644
--- a/apps/browser/src/auth/popup/two-factor.component.html
+++ b/apps/browser/src/auth/popup/two-factor.component.html
@@ -113,7 +113,10 @@
       "
     >
       <div id="duo-frame">
-        <iframe id="duo_iframe" sandbox="allow-scripts allow-forms allow-same-origin"></iframe>
+        <iframe
+          id="duo_iframe"
+          sandbox="allow-scripts allow-forms allow-same-origin allow-popups allow-popups-to-escape-sandbox"
+        ></iframe>
       </div>
       <div class="box">
         <div class="box-content">
diff --git a/apps/desktop/src/auth/two-factor.component.html b/apps/desktop/src/auth/two-factor.component.html
index cd21f91f59..2b9a1722ee 100644
--- a/apps/desktop/src/auth/two-factor.component.html
+++ b/apps/desktop/src/auth/two-factor.component.html
@@ -83,7 +83,10 @@
       "
     >
       <div id="duo-frame">
-        <iframe id="duo_iframe" sandbox="allow-scripts allow-forms allow-same-origin"></iframe>
+        <iframe
+          id="duo_iframe"
+          sandbox="allow-scripts allow-forms allow-same-origin allow-popups allow-popups-to-escape-sandbox"
+        ></iframe>
       </div>
       <div class="box last">
         <div class="box-content">
diff --git a/apps/web/src/app/auth/two-factor.component.html b/apps/web/src/app/auth/two-factor.component.html
index e3617a1658..99d40e1f3e 100644
--- a/apps/web/src/app/auth/two-factor.component.html
+++ b/apps/web/src/app/auth/two-factor.component.html
@@ -92,7 +92,7 @@
             <div id="duo-frame" class="mb-3">
               <iframe
                 id="duo_iframe"
-                sandbox="allow-scripts allow-forms allow-same-origin"
+                sandbox="allow-scripts allow-forms allow-same-origin allow-popups allow-popups-to-escape-sandbox"
               ></iframe>
             </div>
           </ng-container>