bitwarden / bitwarden/android

[PM-41914] [PM-40883 Related] WebAuthn 2FA: Timeout and Cloudflare 522 Error when Firefox is the default browser

Open
#7,264 5 comments 1 reaction 0 assignees View on GitHub
app:password-manager bug
Dominant language
Kotlin
Stars
9.4k
Forks
1.1k
Avg merge
1d 14h
Merged PRs (30d)
67

Description

### Steps To Reproduce

1. Set **Firefox for Android** as the system's default browser.
2. Open the Bitwarden Android app and attempt to log in using an account protected by WebAuthn/FIDO2 2FA (EU Cloud).
3. Select YubiKey (via USB-C or NFC) for 2FA.
4. When the WebAuthn prompt opens via Custom Tabs, enter the YubiKey PIN / complete User Verification.

### Expected Result

The WebAuthn authentication completes successfully, the Custom Tab closes, and the user is logged into the Bitwarden app.

### Actual Result

After completing the YubiKey PIN/User Verification prompt, the request hangs, times out, and displays a Cloudflare Error 522 page instead of redirecting back to the app.

### Screenshots or Videos

_No response_

### Additional Context

- **Workaround:** Changing the default browser from Firefox to Google Chrome immediately resolves the issue, allowing the WebAuthn flow to complete without any errors.
- **Related Issue:** This seems closely related to (or a variation of) https://github.com/bitwarden/android/issues/7205 (PM-40883), though in this case, it results in a Cloudflare 522 timeout during the YubiKey PIN/UV step rather than a 404 page.
- **Mozilla Bug:** I have also submitted a bug report to Mozilla (Bug ID: 2063051) to cover both sides of the integration issue.

### Build Version

2026.7.0 (21756)

### What server are you connecting to?

EU

### Self-host Server Version

_No response_

### Environment Details

- **Device:** Google Pixel 7
- **OS:** Android 17
- **Default Browser:** Firefox for Android (Fails with 522) vs Google Chrome (Works)
- **2FA Method:** YubiKey (USB-C / NFC) with PIN/User Verification

### Issue Tracking Info

- [x] I understand that work is tracked outside of Github. A PR will be linked to this issue should one be opened to address it, but Bitwarden doesn't use fields like "assigned", "milestone", or "project" to track progress.

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the WebAuthn/FIDO2 login flow with Firefox for Android as the default browser, then compare it with Chrome using the YubiKey USB-C and NFC paths. The issue is resolved when verification completes, the Custom Tab closes, and the user is logged in without a timeout or Cloudflare 522 page.

Written by the indexing model from the issue text.

Assessment

Tech stack
android, kotlin
Domain
authentication, mobile
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.