bitwarden / bitwarden/android

[PM-25632] Log in with device - entered email is case-sensitive for fingerprint phrase generation

Open
#5,856 3 comments 0 reactions 0 assignees View on GitHub
app:password-manager bug
Dominant language
Kotlin
Stars
9.4k
Forks
1.1k
Avg merge
1d 14h
Merged PRs (30d)
67

Description

### Steps To Reproduce

1. Have an existing BW client logged in
2. Begin new device login from Android app
3. Enter email address with arbitrary capitalisation (eg autocomplete capitalising first letter)
4. Choose Log in with device
5. Note fingerprint phrase mismatch between devices

### Expected Result

Login attempt either fails to recognise account, or completes successfully with matching fingerprint.

### Actual Result

Existing device receives an auth prompt with mismatched fingerprint phrase.

### Screenshots or Videos

_No response_

### Additional Context

The desktop apps convert email to lowercase before generating fingerprint in [desktop auth-request.service.ts:224](https://github.com/bitwarden/clients/blob/main/libs/auth/src/common/services/auth-request/auth-request.service.ts#L224).
The Android app does not, see [Android AuthRequestManagerImpl.kt:472](https://github.com/bitwarden/android/blob/main/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/manager/AuthRequestManagerImpl.kt#L472) and [Android AuthSdkSourceImpl.kt:45](https://github.com/bitwarden/android/blob/main/app/src/main/kotlin/com/x8bit/bitwarden/data/auth/datasource/sdk/AuthSdkSourceImpl.kt#L45).
From what I can see in the iOS codebase it also seems to use the provided email without lowercasing it, see [iOS AuthService.swift:832](https://github.com/bitwarden/ios/blob/main/BitwardenShared/Core/Auth/Services/AuthService.swift#L832)

### Build Version

2025.8.1 (20670)

### What server are you connecting to?

US

### Self-host Server Version

_No response_

### Environment Details

_No response_

### Issue Tracking Info

- [x] I understand that work is tracked outside of Github. A PR will be linked to this issue should one be opened to address it, but Bitwarden doesn't use fields like "assigned", "milestone", or "project" to track progress.

Contributor guide

Open the contributing guide

Research direction

Start with AuthRequestManagerImpl.kt:472 and AuthSdkSourceImpl.kt:45, then compare the desktop auth-request.service.ts:224 behavior and the iOS AuthService.swift:832 path. Trace how the entered email reaches fingerprint phrase generation and verify that differently capitalized inputs produce the expected matching fingerprint during device login.

Written by the indexing model from the issue text.

Assessment

Tech stack
kotlin
Domain
authentication, mobile
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.