Security Disclosure Recommendation: Resolving Login Issues

Author: Mykal Machon

This guide is part of Railway's response to the security disclosure published on October 21, 2026.

During the October 21st security incident, Railway revoked all login sessions and stored credentials. Follow the Railway status page for the latest updates. Everyone must log in again. This guide covers how to log in, what to check if login fails, and how to reach support with the information needed to restore access.

## Log in with your original account

You must log in with the exact Gmail, GitHub account, or email you used when you first signed up for Railway unless you have since changed these connections from your account settings.

Railway matches your login to your existing account by that identity. Logging in with a different email or a different GitHub account creates a new, empty account instead of restoring your existing one. If you see an empty dashboard with no projects after logging in, you have likely logged in to the wrong identity

• If you signed up with GitHub, log in with GitHub using the same GitHub username.
• If you signed up with email, enter the same email address and use the login link sent to that inbox.
• If you later changed your account email in settings, use the updated address.

## Debug a failing login

Work through these checks before contacting support.

1. Confirm the identity. Check which email or GitHub account you used originally. Old Railway emails (invoices, deploy notifications) in your inbox show the address on the account.
2. Check for a login email. Email login links are single-use and expire. Look in spam and request a new link if the first one expired.
3. Retry GitHub authorization. If GitHub login loops or errors, open your GitHub authorized OAuth apps, revoke Railway, and log in again to authorize from scratch.
4. Clear state in the browser. Use a private window or clear cookies for railway.com, then try again.
5. Complete two-factor authentication. If you enabled 2FA, you must enter a code from your authenticator app. If you lost the device, use a recovery code.
6. Log out of the CLI. If railway login fails from the terminal, run railway logout first, then railway login again.

If you log in and your projects are missing, do not create new projects on the empty account. Log out and retry with the original identity, or contact support with the template below.

## Contact support to restore access

If you still can't log in, for example because you no longer have access to the email address you originally signed up with, support can restore access to your account. The same applies if you log in and your projects are missing.

You must still have access to the GitHub account connected to your Railway account. Railway uses it to verify ownership before restoring access. Without it, support can't confirm the account is yours.

Send a request to support using the template below and include every item. The GitHub repository step lets the team confirm you control the GitHub account quickly. Railway asks for this out of an abundance of caution, so we can restore access safely and with as little delay as possible.

### Prove ownership of your GitHub account

1. Log in to GitHub as the account you used for Railway.
2. Create a new public repository named Railway-2FA-Reset.
3. You can leave it empty; we'll use it as 2FA proof.
4. Copy the repository URL for the template below.

Delete the repository after support confirms your access is restored.

### Support request template

Copy this into your support request or email and fill in each line.

Subject: Account access recovery after the October 21st security incident

Account email: <the email on your Railway account>
Can you still access that email: <yes or no>
GitHub username: <the GitHub username connected to your Railway account>
Ownership proof repository: https://github.com/<your-username>/Railway-2FA-Reset
What happens when you log in: <error message, redirect loop, or empty dashboard>
Workspace / Service / Project names: include the name of your workspace, services, projects, and a domain if possible
New email to use for the account, if any: <email address>

When possible, send the request from the email address on your account. If you can't, send it from the address you want support to reply to and explain why the original is unavailable. Support replies once ownership is confirmed.

Do not send passwords, login codes, recovery codes, API tokens, or secret values.

## Next steps

After you regain access, recreate any revoked credentials and redeploy services that fell behind during the incident. See Recover failing deploys after the October 21st security incident.