bitwarden / bitwarden/android

Bitwarden silently resets your account settings every time you log out and log back in, without the user's knowledge - security problem.

Open
#6,887 9 comments 3 reactions 0 assignees View on GitHub
app:password-manager bug
Dominant language
Kotlin
Stars
9.4k
Forks
1.1k
Avg merge
1d 14h
Merged PRs (30d)
67

Description

### Steps To Reproduce

- Install Bitwarden on a new device from google play store (tried google pixel 10 xl, android 16) (also tried android 13, samsung)
- Log in (email, password, 2fa, remember me).
- Set your settings: `Other settings`: `Clear clipboard`: 10s, `Allow sync on refresh`: true. `Account Security`: `Session timeout`: 1minute.
- Then Lock, then Log out.
- Then Log in again.
- Your settings are now all reset to defaults.

Major security risk: user still thinks their clipboard will be cleared in 10s. Hands the phone to someone else tomorrow. The password is still in the clipboard. -- No matter what your agenda is, may I suggest you have a "clear clipboard on lock" with ON by Default??????? Most if not ALL open source password managers do this.

### Expected Result

The settings are saved in the logged in account's settings page. This means the user expects the settings to be there when they log in. You should tie the settings to an ID generated by the device id + the user account.

The fact that you reset the settings on us without telling us, leads to major password leak issues as the user doesn't know the app no loonger locks or logs out immediately / according to their explicit settings. And also the clipboard is not cleared any more, without warning.

### Actual Result

The settings are saved in the logged in account's settings page. This means the user expects the settings to be there when they log in. You should tie the settings to an ID generated by the device id + the user account.

The fact that you reset the settings on us without telling us, leads to major password leak issues as the user doesn't know the app no loonger locks or logs out immediately / according to their explicit settings. And also the clipboard is not cleared any more, without warning.

### Screenshots or Videos

_No response_

### Additional Context

_No response_

### Build Version

Pixel 10 (app from mobileapp.bitwarden.com/fdroid/repo):

Version: 2026.4.0 (21434)
📱 google Pixel 10 XL 🤖 16@36 📦 prod -fdroid
🧱 commit: bitwarden/android/release/2026.4-rc50@61955d7cbe1546a4c467284b4a5491d4f0e47afa
💻 build source: bitwarden/android/actions/runs/23952219208/attempts/1
🦀 SDK: 2.0.0-5676-14521973
🌩 Server: 2026.4.1 @ US

Samsung tablet (app from google play store):

Version: 2026.4.0 (21434)
📱 samsung SM-T97x 🤖 13@33 📦 prod
🧱 commit: bitwarden/android/release/2026.4-rc50@61955d7cbe1546a4c467284b4a5491d4f0e47afa
💻 build source: bitwarden/android/actions/runs/23952219208/attempts/1
🦀 SDK: 2.0.0-5676-14521973
🌩 Server: 2026.4.1 @ US

### What server are you connecting to?

US

### Self-host Server Version

_No response_

### Environment Details

Pixel 10 XL. Android 16.
Samsung, Android 13.

### Issue Tracking Info

- [x] I understand that work is tracked outside of Github. A PR will be linked to this issue should one be opened to address it, but Bitwarden doesn't use fields like "assigned", "milestone", or "project" to track progress.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.