bitwarden / bitwarden/android

[PM-40273] Duplicate biometric prompt when using Passkeys while Vault is already unlocked

Open
#7,161 2 comments 0 reactions 0 assignees View on GitHub
app:password-manager bug-passkey
Dominant language
Kotlin
Stars
9.4k
Forks
1.1k
Avg merge
1d 14h
Merged PRs (30d)
67

Description

### Origin

Web (Browser)

### Web URL or App name

Every website

### Passkey Action

- [ ] Creating new passkey (Registration)
- [x] Signing in (Authentication)

### Build Information

© Bitwarden Inc. 2015-2026

版本:2026.6.0 (21686)
📱 google Pixel 10a 🤖 17@37 📦 prod
🧱 commit: bitwarden/android/release/2026.6-rc56@cc9b7d3edf77f523433f6a8cda5577e56ae1a4e2
💻 build source: bitwarden/android/actions/runs/27437870956/attempts/1
🦀 SDK: 3.0.0-7338-5bdc976f
🌩 Server: 2026.6.2 @ US

### Additional Information

Steps to Reproduce:

Set the Vault timeout to "Immediately" in the Bitwarden Android app.

Navigate to a website or app that supports Passkeys.

Trigger the Passkey login.

Biometric prompt 1: Authenticate to unlock the Bitwarden vault.

Biometric prompt 2: Bitwarden immediately requests a second biometric authentication specifically for the Passkey.

Expected Behavior:
If the vault is already unlocked (or has just been unlocked in the previous step), using a Passkey should not require an additional biometric prompt. It should behave like standard password autofill, which fills credentials seamlessly once the vault is open.

Actual Behavior:
The app enforces a redundant biometric check for the Passkey itself, resulting in back-to-back fingerprint scans every time a Passkey is used.

Additional Context:
Other password managers, such as Proton Pass, do not require this secondary verification for Passkeys once the vault is unlocked.

### Issue Tracking Info

- [x] I understand that work is tracked outside of Github. A PR will be linked to this issue should one be opened to address it, but Bitwarden doesn't use fields like "assigned", "milestone", or "project" to track progress.

Contributor guide

Open the contributing guide

Research direction

Start by tracing the Android Passkey login flow from authentication through vault unlocking and the biometric prompts. Identify where the second biometric check is triggered after the vault has just been unlocked, then verify that Passkey authentication requires only the unlock prompt and add or update regression coverage for the reported sequence.

Written by the indexing model from the issue text.

Assessment

Tech stack
android, kotlin
Domain
authentication, mobile
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.