[PM-40273] Duplicate biometric prompt when using Passkeys while Vault is already unlocked
- Dominant language
- Kotlin
- Stars
- 9.4k
- Forks
- 1.1k
- Avg merge
- 1d 14h
- Merged PRs (30d)
- 67
Description
### Origin
Web (Browser)
### Web URL or App name
Every website
### Passkey Action
- [ ] Creating new passkey (Registration)
- [x] Signing in (Authentication)
### Build Information
© Bitwarden Inc. 2015-2026
版本:2026.6.0 (21686)
📱 google Pixel 10a 🤖 17@37 📦 prod
🧱 commit: bitwarden/android/release/2026.6-rc56@cc9b7d3edf77f523433f6a8cda5577e56ae1a4e2
💻 build source: bitwarden/android/actions/runs/27437870956/attempts/1
🦀 SDK: 3.0.0-7338-5bdc976f
🌩 Server: 2026.6.2 @ US
### Additional Information
Steps to Reproduce:
Set the Vault timeout to "Immediately" in the Bitwarden Android app.
Navigate to a website or app that supports Passkeys.
Trigger the Passkey login.
Biometric prompt 1: Authenticate to unlock the Bitwarden vault.
Biometric prompt 2: Bitwarden immediately requests a second biometric authentication specifically for the Passkey.
Expected Behavior:
If the vault is already unlocked (or has just been unlocked in the previous step), using a Passkey should not require an additional biometric prompt. It should behave like standard password autofill, which fills credentials seamlessly once the vault is open.
Actual Behavior:
The app enforces a redundant biometric check for the Passkey itself, resulting in back-to-back fingerprint scans every time a Passkey is used.
Additional Context:
Other password managers, such as Proton Pass, do not require this secondary verification for Passkeys once the vault is unlocked.
### Issue Tracking Info
- [x] I understand that work is tracked outside of Github. A PR will be linked to this issue should one be opened to address it, but Bitwarden doesn't use fields like "assigned", "milestone", or "project" to track progress.
Contributor guide
Research direction
Start by tracing the Android Passkey login flow from authentication through vault unlocking and the biometric prompts. Identify where the second biometric check is triggered after the vault has just been unlocked, then verify that Passkey authentication requires only the unlock prompt and add or update regression coverage for the reported sequence.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- android, kotlin
- Domain
- authentication, mobile
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100