bitwarden / bitwarden/android

[PM-29114] VC 20967 is not enumerated by `com.google.android.gms.fido.fido2.ui.hybrid.HybridAuthenticateActivity`, at least when logging-in to `NNGCECKBAPEBFIMNLNIIIAHKANDCLBLB_2025_11_1_0.crx`'s `popup/index.html?uilocation=popout#/login`.

Open
#6,219 11 comments 1 reaction 0 assignees View on GitHub
app:password-manager bug-passkey
Dominant language
Kotlin
Stars
9.4k
Forks
1.1k
Avg merge
1d 14h
Merged PRs (30d)
67

Description

### Origin

Web (Browser)

### Web URL or App name

`chrome-extension://nngceckbapebfimnlniiiahkandclblb/popup/index.html?uilocation=popout#/login:~:text=Log%20in%20with%20passkey`

### Passkey Action

- [ ] Creating new passkey (Registration)
- [x] Signing in (Authentication)

### Build Information

~~~YAML
© Bitwarden Inc. 2015-2025
Version: 2025.11.0 (20967)
📱 Fairphone FP5 🤖 15@35 📦 prod
🧱 commit: bitwarden/android/release/2025.10-rc38@6d71f0c5d66a466a20e4636be438609d2703063c
💻 build source: bitwarden/android/actions/runs/19309927902/attempts/1
🦀 SDK: 1.0.0-3436-2a00b727
🌩 Server: 2025.11.1 @ US
~~~

### Additional Information

In order to complete the authentication sequence that [`clients/issues/17779`](https://github.com/bitwarden/clients/issues/17779#issue-3686782229) describes (before I knew how to bypass it), I utilised [`versionCode=49` of `com.atharok.barcodescanner`](https://gitlab.com/Atharok/BarcodeScanner/-/releases/1.26.0#:~:text=1.26.0%2Devidences%2D16473952.json-,833d824d,-Collected%2015%20Nov) to invoke the resultant `FIDO:/` URI via `com.atharok.barcodescanner.presentation.views.activities.BarcodeAnalysisActivity`, which invoked `com.google.android.gms.fido.fido2.ui.hybrid.HybridAuthenticateActivity`. There, like what [`issues/6112`](https://github.com/bitwarden/android/issues/6112#issue-3580172369) describes, `com.x8bit.bitwarden` was not enumerated.

To demonstrate, I've utilised what [`dkrivoruchko/ScreenStream/issues/337`](https://github.com/dkrivoruchko/ScreenStream/issues/337#issue-3686889960) describes:

https://github.com/user-attachments/assets/df7de006-f650-47eb-a184-51950cc2aaf9

If Flight Recorder is of any use for this, I've uploaded its logs to [`user-attachments/files/23887555/bitwarden_flight_recorder2971687947327785176.zip`](https://github.com/user-attachments/files/23887555/bitwarden_flight_recorder2971687947327785176.zip). However, because of how [`AChep/keyguard-app/issues/1140`](https://github.com/AChep/keyguard-app/issues/1140#issue-3687128004) demonstrates that no alternative, enumerated clients are able authenticate, I wonder whether the code itself may be at fault, somehow, too.

### Issue Tracking Info

- [x] I understand that work is tracked outside of Github. A PR will be linked to this issue should one be opened to address it, but Bitwarden doesn't use fields like "assigned", "milestone", or "project" to track progress.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.