github-starred/android
2
0
Fork 0
mirror of https://github.com/bitwarden/android.git synced 2026-05-07 19:39:41 -05:00
Code Issues 1.1k Packages Projects Releases 122 Wiki Activity

[GH-ISSUE #6241] [PM-29302] Credential Manager unlock loop - without any corresponding credentials in my vault #21659

New Issue
Open
opened 2026-04-16 22:13:34 -05:00 by GiteaMirror · 6 comments
GiteaMirror commented 2026-04-16 22:13:34 -05:00
Owner
Copy Link

Originally created by @pamperer562580892423 on GitHub (Dec 6, 2025).
Original GitHub issue: https://github.com/bitwarden/android/issues/6241

Steps To Reproduce

Precondition: In my case, I now have no credentials for the target website (LinkedIn in my example) in my BW vault (no email/username, password, passkey... nothing)! And I would add, since the credential manager popping up here in general - which is a relatively new behaviour of the Android app - I think this may also be a (tangential) "passkey issue", since in other cases, I see the credential manager popping up offering me "automatic" passkey login to the website (so the credential manager popping up seems mostly to be connected to passkey-login to sites - but I may be in error here)...

  1. Go to https://www.linkedin.com/login/... (in my case: https://www.linkedin.com/login/de?...)
  2. Click on the "Email address / phone" field there.
  3. If everything is set up for it accordingly, the BW credential manager pops up.
  4. Click on 'Continue'.

Important for reproduction: that credential manager popup seems to be very browser dependent! On Vivaldi, as you can see in the video, it pops up for me. On Firefox, the credential manager doesn't even pop up on LinkedIn for me. - On Brave and Chrome, just as I tried it again, the credential manager does pop up now (but I think I tried it two days ago on Chrome and Brave before, and at least on one those two browsers, the credential manager didn't pop up then...?!)

Expected Result

In my case now, as I don't have any credentials in my BW vault for the website (LinkedIn): at least a message that no matching credentials were found.

And BW should show that my vault is already unlocked after the first unlock - and the app shouldn't let me go into an "unlock loop".

Actual Result

After I clicked continue, BW searches for credentials in my BW vault... doesn't find any... get's back to the credential manager popup and offers me to unlock again.

Though my vault should still be unlocked in the BW app... And if I click "continue" again, I end in a loop... (if I wanted to click "continue" always again...)

Screenshots or Videos

https://github.com/user-attachments/assets/49ec4d5d-f20a-4439-85c4-179ef3b4c0fc

At then end, you can also see in that video, that when I finally close the credential manager with the "x", then BW offers me nothing when I click in the login fields. (maybe BW needs to rest after that looping?! joke)

Additional Context

Since the credential manager coming up at all is not part of the official documentation (https://bitwarden.com/help/auto-fill-android/#use-passkeys) I would suggest - besides fixing this loop bug - that the whole new "credential manager thing" should also be documented there. This section of the Help Sites needs an update.

(Also, that the credential manager pops up automatically now when there is a valid passkey for a site in my BW vault is not yet documented in the Help Sites at all. - The Help Sites only mention a "passkey popup" on the Android app, when someone intentionally clicks a "Passkey login" button on a given site.)

PS: Regarding the unlock itself: my BW app is set to "Lock / after two minutes" as "session timeout", so the App should indeed be unlocked after the first unlock. (it probably would be a different situation if my BW app was set to "immediately lock", but it isn't)

PPS: I also saw this report of two others users, getting "confused" with this new credential manager popping up in various situations: https://community.bitwarden.com/t/android-sign-in-popup-leads-nowhere-for-some-websites/91087

Build Version

2025.11.0

What server are you connecting to?

EU

Self-host Server Version

(not self-hosting)

Environment Details

© Bitwarden Inc. 2015-2025

Version: 2025.11.0 (20967)
📱 Fairphone FP5 🤖 15@35 📦 prod
🧱 commit: bitwarden/android/release/2025.10-rc38@6d71f0c5d66a466a20e4636be438609d2703063c
💻 build source: bitwarden/android/actions/runs/19309927902/attempts/1
🦀 SDK: 1.0.0-3436-2a00b727
🌩 Server: 2025.11.1 @ EU

Issue Tracking Info

  • I understand that work is tracked outside of Github. A PR will be linked to this issue should one be opened to address it, but Bitwarden doesn't use fields like "assigned", "milestone", or "project" to track progress.
Originally created by @pamperer562580892423 on GitHub (Dec 6, 2025). Original GitHub issue: https://github.com/bitwarden/android/issues/6241 ### Steps To Reproduce Precondition: In my case, I now have **no** credentials for the target website (LinkedIn in my example) in my BW vault (no email/username, password, passkey... nothing)! And I would add, since the credential manager popping up here in general - which is a relatively new behaviour of the Android app - I think this may also be a (tangential) "passkey issue", since in other cases, I see the credential manager popping up offering me "automatic" passkey login to the website (so the credential manager popping up seems mostly to be connected to passkey-login to sites - but I may be in error here)... 1. Go to https://www.linkedin.com/login/... (in my case: https://www.linkedin.com/login/de?...) 2. Click on the "Email address / phone" field there. 3. If everything is set up for it accordingly, the BW credential manager pops up. 4. Click on 'Continue'. **Important for reproduction:** that credential manager popup seems to be **very browser dependent**! On Vivaldi, as you can see in the video, it pops up for me. On Firefox, the credential manager doesn't even pop up on LinkedIn for me. - On Brave and Chrome, just as I tried it again, the credential manager does pop up now (but I think I tried it two days ago on Chrome and Brave before, and at least on one those two browsers, the credential manager didn't pop up then...?!) ### Expected Result In my case now, as I **don't** have **any** credentials in my BW vault for the website (LinkedIn): at least a message that no matching credentials were found. And BW should show that my vault is already unlocked after the first unlock - and the app shouldn't let me go into an "unlock loop". ### Actual Result After I clicked continue, BW searches for credentials in my BW vault... doesn't find any... get's back to the credential manager popup and offers me to unlock again. Though my vault should still be unlocked in the BW app... And if I click "continue" again, I end in a loop... (if I wanted to click "continue" always again...) ### Screenshots or Videos https://github.com/user-attachments/assets/49ec4d5d-f20a-4439-85c4-179ef3b4c0fc At then end, you can also see in that video, that when I finally close the credential manager with the "x", then BW offers me **nothing** when I click in the login fields. (maybe BW needs to rest after that looping?! *joke*) ### Additional Context Since the credential manager coming up at all is not part of the official documentation (https://bitwarden.com/help/auto-fill-android/#use-passkeys) I would suggest - besides fixing this loop bug - that the whole new "credential manager thing" should also be documented there. This section of the Help Sites needs an update. (Also, that the credential manager pops up automatically now when there is a valid passkey for a site in my BW vault is not yet documented in the Help Sites at all. - The Help Sites only mention a "passkey popup" on the Android app, when someone intentionally clicks a "Passkey login" button on a given site.) PS: Regarding the unlock itself: my BW app is set to "Lock / after two minutes" as "session timeout", so the App should indeed be unlocked after the first unlock. (it probably would be a different situation if my BW app was set to "immediately lock", but it isn't) PPS: I also saw this report of two others users, getting "confused" with this new credential manager popping up in various situations: https://community.bitwarden.com/t/android-sign-in-popup-leads-nowhere-for-some-websites/91087 ### Build Version 2025.11.0 ### What server are you connecting to? EU ### Self-host Server Version (not self-hosting) ### Environment Details © Bitwarden Inc. 2015-2025 Version: 2025.11.0 (20967) 📱 Fairphone FP5 🤖 15@35 📦 prod 🧱 commit: bitwarden/android/release/2025.10-rc38@6d71f0c5d66a466a20e4636be438609d2703063c 💻 build source: bitwarden/android/actions/runs/19309927902/attempts/1 🦀 SDK: 1.0.0-3436-2a00b727 🌩 Server: 2025.11.1 @ EU ### Issue Tracking Info - [x] I understand that work is tracked outside of Github. A PR will be linked to this issue should one be opened to address it, but Bitwarden doesn't use fields like "assigned", "milestone", or "project" to track progress.
GiteaMirror added the app:password-managerbug labels 2026-04-16 22:13:35 -05:00
GiteaMirror commented 2026-04-16 22:13:35 -05:00
Author
Owner
Copy Link

@bitwarden-bot commented on GitHub (Dec 6, 2025):

Thank you for your report! We've added this to our internal board for review.
ID: PM-29302

<!-- gh-comment-id:3620593505 --> @bitwarden-bot commented on GitHub (Dec 6, 2025): Thank you for your report! We've added this to our internal board for review. ID: [PM-29302](https://bitwarden.atlassian.net/browse/PM-29302) [PM-29302]: https://bitwarden.atlassian.net/browse/PM-29302?atlOrigin=eyJpIjoiNWRkNTljNzYxNjVmNDY3MDlhMDU5Y2ZhYzA5YTRkZjUiLCJwIjoiZ2l0aHViLWNvbS1KU1cifQ
GiteaMirror commented 2026-04-16 22:13:35 -05:00
Author
Owner
Copy Link

@SergeantConfused commented on GitHub (Dec 8, 2025):

Hello @pamperer562580892423,

Thank you for this detailed report. I've tested this with Vivaldi and Chrome on a Pixel 8 Pro running Android 16, and I'm getting the autofill popup consistently; at no point was the Android Credential Manager shown. However, I tested that with Bitwarden 2025.11.1; could you please update your Bitwarden client, reboot the phone, and let me know if you're still able to reproduce that?

Thank you in advance,

<!-- gh-comment-id:3626743961 --> @SergeantConfused commented on GitHub (Dec 8, 2025): Hello @pamperer562580892423, Thank you for this detailed report. I've tested this with Vivaldi and Chrome on a Pixel 8 Pro running Android 16, and I'm getting the autofill popup consistently; at no point was the Android Credential Manager shown. However, I tested that with Bitwarden 2025.11.1; could you please update your Bitwarden client, reboot the phone, and let me know if you're still able to reproduce that? Thank you in advance,
GiteaMirror commented 2026-04-16 22:13:36 -05:00
Author
Owner
Copy Link

@pamperer562580892423 commented on GitHub (Dec 8, 2025):

@SergeantConfused Thanks for your initial testing. - And of course, when 2025.11.1 arrives on my phone, I'll check the behaviour again and report back.

<!-- gh-comment-id:3627011255 --> @pamperer562580892423 commented on GitHub (Dec 8, 2025): @SergeantConfused Thanks for your initial testing. - And of course, when 2025.11.1 arrives on my phone, I'll check the behaviour again and report back.
GiteaMirror commented 2026-04-16 22:13:36 -05:00
Author
Owner
Copy Link

@pamperer562580892423 commented on GitHub (Dec 9, 2025):

[PS/Edit: It seems, as I made this update-post here, I somehow "forgot", that I originally reported it, and recorded it on video, with Vivaldi browser -- and now here in this post, everything I described I experienced with Brave browser... but now I checked it again with Vivaldi and BW app version 2025.11.1, and it's the same behaviour as I reported in my original post. -- And maybe, this post here now is not bad at all, as it shows, I also could reproduce the general behaviour also on Brave and BW app version 2025.11.1.)

@SergeantConfused ... and 2025.11.1 arrived. And I rebooted the phone. I can report, that the behaviour changed a bit (compare with my previous video), but it's not gone (and especially the "unlock loop" is still there):

https://github.com/user-attachments/assets/a8afbaea-9f20-4c78-9051-840d6f110711

What's changed (2025.11.0 --> 2025.11.1):

  1. Before, the Credential Manager popped up directly. - As you can see, I can trigger the credential manager now by first tapping the email field, then tapping the password field and then tapping the email field again. --> Can you trigger the Credential Manager like that as well? -- (BTW, what's positive before the Credential Manager comes up now with 2025.11.1: when I tap in both fields, BW is shown in the inline keyboard menu)

  2. (Then, I can enter the same "unlock loop" as before.)

  3. Positive change: When I close the Credential Manager (and quit the "unlock loop"), and when I now tap into the fields again, BW also is now shown in the inline keyboard menu.

Here the complete link, if it helps (I guess not, but anyway): https://www.linkedin.com/login/de?lipi=urn%3Ali%3Apage%3Adeeplink_linkedinmobileapp%3BKCF2gEZgSSak9%2Foumw9Vfg%3D%3D&destType=web&fromSignIn=true&trk=guest_homepage-basic_nav-header-signin

New Environment Details:

© Bitwarden Inc. 2015-2025

Version: 2025.11.1 (20994)
📱 Fairphone FP5 🤖 15@35 📦 prod
🧱 commit: bitwarden/android/release/2025.11-rc39@63c4e1fe9314d2b2f2c0989b5bb8c265b3cbc57e
💻 build source: bitwarden/android/actions/runs/19583271293/attempts/2
🦀 SDK: 1.0.0-3436-2a00b727
🌩 Server: 2025.11.1 @ EU

PS: I can add: I rebooted the phone another time now... and guess what: I also saw the previous behaviour (as I reported it with mobile app 2025.11.0) at least once... so it's not completely consistent what triggers the Credential Manager...

PPS: Brave is always up-to-date via the PlayStore on my device. (auto-updates and active regular manual search for updates)

<!-- gh-comment-id:3629572703 --> @pamperer562580892423 commented on GitHub (Dec 9, 2025): [PS/Edit: It seems, as I made this update-post here, I somehow "forgot", that I originally reported it, and recorded it on video, with Vivaldi browser -- and now here in this post, everything I described I experienced with Brave browser... but now I checked it again with Vivaldi and BW app version 2025.11.1, and it's the same behaviour as I reported in my original post. -- And maybe, this post here now is not bad at all, as it shows, I also could reproduce the general behaviour also on Brave and BW app version 2025.11.1.) @SergeantConfused ... and 2025.11.1 arrived. And I rebooted the phone. I can report, that the behaviour changed a bit (compare with my previous video), but it's not gone (and especially the "unlock loop" is still there): https://github.com/user-attachments/assets/a8afbaea-9f20-4c78-9051-840d6f110711 What's changed (2025.11.0 --> 2025.11.1): 1. Before, the Credential Manager popped up directly. - As you can see, I can trigger the credential manager now by first tapping the email field, then tapping the password field and then tapping the email field again. --> Can you trigger the Credential Manager like that as well? -- (BTW, what's positive before the Credential Manager comes up now with 2025.11.1: when I tap in both fields, BW is shown in the inline keyboard menu) 2. (Then, I can enter the same "unlock loop" as before.) 3. Positive change: When I close the Credential Manager (and quit the "unlock loop"), and when I now tap into the fields again, BW also is now shown in the inline keyboard menu. Here the complete link, if it helps (I guess not, but anyway): https://www.linkedin.com/login/de?lipi=urn%3Ali%3Apage%3Adeeplink_linkedinmobileapp%3BKCF2gEZgSSak9%2Foumw9Vfg%3D%3D&destType=web&fromSignIn=true&trk=guest_homepage-basic_nav-header-signin New Environment Details: © Bitwarden Inc. 2015-2025 Version: 2025.11.1 (20994) 📱 Fairphone FP5 🤖 15@35 📦 prod 🧱 commit: bitwarden/android/release/2025.11-rc39@63c4e1fe9314d2b2f2c0989b5bb8c265b3cbc57e 💻 build source: bitwarden/android/actions/runs/19583271293/attempts/2 🦀 SDK: 1.0.0-3436-2a00b727 🌩 Server: 2025.11.1 @ EU PS: I can add: I rebooted the phone another time now... and guess what: I also saw the previous behaviour (as I reported it with mobile app 2025.11.0) at least once... so it's not completely consistent what triggers the Credential Manager... PPS: Brave is always up-to-date via the PlayStore on my device. (auto-updates and active regular manual search for updates)
GiteaMirror commented 2026-04-16 22:13:36 -05:00
Author
Owner
Copy Link

@pamperer562580892423 commented on GitHub (Dec 12, 2025):

Ahhhhhh... @SergeantConfused I only now saw that I originally reported it with Vivaldi (with app 2025.11.0) -- and in my update I used Brave (with app 2025.11.1). (and I don't call for an adoption, but maybe I'm PampererConfused...)

I can add, that it is still and indeed the exact same behaviour on Vivaldi, as I originally reported it (see that video) - also on app 2025.11.1.

But maybe not bad, that I could also reproduce this with Brave and app version 2025.11.1...

<!-- gh-comment-id:3646544401 --> @pamperer562580892423 commented on GitHub (Dec 12, 2025): Ahhhhhh... @SergeantConfused I only now saw that I originally reported it with Vivaldi (with app 2025.11.0) -- and in my update I used Brave (with app 2025.11.1). (and I don't call for an adoption, but maybe I'm PampererConfused...) I can add, that it is still and indeed the exact same behaviour on Vivaldi, as I originally reported it (see that video) - also on app 2025.11.1. But maybe not bad, that I could also reproduce this with Brave and app version 2025.11.1...
GiteaMirror commented 2026-04-16 22:13:37 -05:00
Author
Owner
Copy Link

@pamperer562580892423 commented on GitHub (Dec 12, 2025):

Oh, 2025.12.0 arrived unexpectedly quick.

Same thing on Vivaldi (first video) and on Brave (second video).

© Bitwarden Inc. 2015-2025

Version: 2025.12.0 (21003)
📱 Fairphone FP5 🤖 15@35 📦 prod
🧱 commit: bitwarden/android/release/2025.12-rc40@f02b374e989600a8458d2884abd2526244241c8a
💻 build source: bitwarden/android/actions/runs/19830126705/attempts/1
🦀 SDK: 1.0.0-3928-2cca3d46
🌩 Server: 2025.12.0 @ EU

<!-- gh-comment-id:3648133514 --> @pamperer562580892423 commented on GitHub (Dec 12, 2025): Oh, 2025.12.0 arrived unexpectedly quick. Same thing on Vivaldi (first video) and on Brave (second video). © Bitwarden Inc. 2015-2025 Version: 2025.12.0 (21003) 📱 Fairphone FP5 🤖 15@35 📦 prod 🧱 commit: bitwarden/android/release/2025.12-rc40@f02b374e989600a8458d2884abd2526244241c8a 💻 build source: bitwarden/android/actions/runs/19830126705/attempts/1 🦀 SDK: 1.0.0-3928-2cca3d46 🌩 Server: 2025.12.0 @ EU
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
app:authenticator
app:password-manager
bug
bug-passkey
customer-support
duplicate
enhancement
good first issue
help wanted
needs-reply
needs-response
pull-request
Mirrored from GitHub Pull Request
 question
No Label app:password-manager bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/android#21659
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?