github-starred/android
2
0
Fork 0
mirror of https://github.com/bitwarden/android.git synced 2026-05-06 07:48:22 -05:00
Code Issues 1.1k Packages Projects Releases 122 Wiki Activity

[GH-ISSUE #6526] [PM-32136] Bitwarden is hallucinating some TOTP verification codes #21728

New Issue
Open
opened 2026-04-16 22:20:54 -05:00 by GiteaMirror · 14 comments
GiteaMirror commented 2026-04-16 22:20:54 -05:00
Owner
Copy Link

Originally created by @zotabee on GitHub (Feb 12, 2026).
Original GitHub issue: https://github.com/bitwarden/android/issues/6526

Steps To Reproduce

Basically, the Bitwarden (full password manager) android app is showing me some TOTP codes for some entries who don't have TOTP key/code at all. (Field completely empty - never used - never filled)

It's definitively a new / recent bug on the Android app. Not sure if it's reproducible.

It's only happening on my most recently created entries, from these past couple days. I noticed because I have a discrepancy of how many TOTP I have between my different password managers.

My usual process is creating entries manually in the web version of Bitwarden. Auto-filling with the addon or Android app when needed to login.

  1. Go to web version of Bitwarden, add some entries (username, password, website but do NOT fill the "Authenticator key" field - leave it empty)
  2. Save it
  3. Check the Android version
  4. Go on TOTP -> Verification codes
  5. I see some entries showing a TOTP code even though they don't have TOTP key! If I edit the entry there is no TOTP code even on the android version.

I confirm that on like my 4-5 most recent entries from the past few days, I have this bug. It's services/websites without TOTP keys.

Interestingly these entries are all showing the same fake TOTP code. No idea where is this getting from.

There is no problem on the web version or the Firefox addon, only happening on the android app. A sync doesn't help.

Expected Result

Don't show TOTP/Verification code if the TOTP field is empty, like it always did in the past.

Actual Result

I'm seeing fake TOTP that doesn't exist for entries that don't have a TOTP at all, never had.

Screenshots or Videos

Image
Image
Image
Image
Image
Image
Image

Additional Context

It seems that only my last newly created logins/entries are impacted, from the last two weeks maybe. From end of January ~31th to Feb 8 are impacted. All created from the web version.

Build Version

© Bitwarden Inc. 2015-2026

Version: 2026.1.1 (21176)
📱 samsung SM-S931B 🤖 16@36 📦 prod
🧱 commit: bitwarden/android/release/2026.1-rc45@0ee3e2e24968837b9c8b260e105751750271540f
💻 build source: bitwarden/android/actions/runs/21527118876/attempts/1
🦀 SDK: 2.0.0-4676-0544ddec
🌩 Server: 2026.1.1 @ US

What server are you connecting to?

EU (well it seems it's US from the android app but I'm EU based)

Self-host Server Version

No response

Environment Details

  • Android app

Issue Tracking Info

  • I understand that work is tracked outside of Github. A PR will be linked to this issue should one be opened to address it, but Bitwarden doesn't use fields like "assigned", "milestone", or "project" to track progress.
Originally created by @zotabee on GitHub (Feb 12, 2026). Original GitHub issue: https://github.com/bitwarden/android/issues/6526 ### Steps To Reproduce Basically, the Bitwarden (full password manager) android app is showing me some TOTP codes for some entries who don't have TOTP key/code at all. (Field completely empty - never used - never filled) It's definitively a new / recent bug on the Android app. Not sure if it's reproducible. It's only happening on my most recently created entries, from these past couple days. I noticed because I have a discrepancy of how many TOTP I have between my different password managers. My usual process is creating entries manually in the web version of Bitwarden. Auto-filling with the addon or Android app when needed to login. 1. Go to web version of Bitwarden, add some entries (username, password, website but do NOT fill the "Authenticator key" field - leave it empty) 2. Save it 3. Check the Android version 4. Go on TOTP -> Verification codes 5. I see some entries showing a TOTP code even though they don't have TOTP key! If I edit the entry there is no TOTP code even on the android version. I confirm that on like my 4-5 most recent entries from the past few days, I have this bug. It's services/websites without TOTP keys. **Interestingly these entries are all showing the same fake TOTP code. No idea where is this getting from.** There is no problem on the web version or the Firefox addon, only happening on the android app. A sync doesn't help. ### Expected Result Don't show TOTP/Verification code if the TOTP field is empty, like it always did in the past. ### Actual Result I'm seeing fake TOTP that doesn't exist for entries that don't have a TOTP at all, never had. ### Screenshots or Videos ![Image](https://github.com/user-attachments/assets/dff24d8d-db5a-4846-9282-c7d30b325daa) ![Image](https://github.com/user-attachments/assets/264fbfdd-33da-4fcf-bca8-da0da62a16b4) ![Image](https://github.com/user-attachments/assets/2b919db3-e96e-4ea5-a1ac-58cacdd8778d) ![Image](https://github.com/user-attachments/assets/318be9a0-9905-4d1a-9c00-6ce237f46222) ![Image](https://github.com/user-attachments/assets/2a4a3353-4f84-4465-81fa-2aee15ced833) ![Image](https://github.com/user-attachments/assets/16199727-80bf-429c-bf57-bb2ded997492) ![Image](https://github.com/user-attachments/assets/89308422-560a-4035-98a3-06dedc9724db) ### Additional Context It seems that only my last newly created logins/entries are impacted, from the last two weeks maybe. From end of January ~31th to Feb 8 are impacted. All created from the web version. ### Build Version © Bitwarden Inc. 2015-2026 Version: 2026.1.1 (21176) 📱 samsung SM-S931B 🤖 16@36 📦 prod 🧱 commit: bitwarden/android/release/2026.1-rc45@0ee3e2e24968837b9c8b260e105751750271540f 💻 build source: bitwarden/android/actions/runs/21527118876/attempts/1 🦀 SDK: 2.0.0-4676-0544ddec 🌩 Server: 2026.1.1 @ US ### What server are you connecting to? EU (well it seems it's US from the android app but I'm EU based) ### Self-host Server Version _No response_ ### Environment Details - Android app ### Issue Tracking Info - [x] I understand that work is tracked outside of Github. A PR will be linked to this issue should one be opened to address it, but Bitwarden doesn't use fields like "assigned", "milestone", or "project" to track progress.
GiteaMirror added the app:password-managerbug labels 2026-04-16 22:20:54 -05:00
GiteaMirror commented 2026-04-16 22:20:56 -05:00
Author
Owner
Copy Link

@bitwarden-bot commented on GitHub (Feb 12, 2026):

Thank you for your report! We've added this to our internal board for review.
ID: PM-32136

<!-- gh-comment-id:3889948777 --> @bitwarden-bot commented on GitHub (Feb 12, 2026): Thank you for your report! We've added this to our internal board for review. ID: [PM-32136](https://bitwarden.atlassian.net/browse/PM-32136) [PM-32136]: https://bitwarden.atlassian.net/browse/PM-32136?atlOrigin=eyJpIjoiNWRkNTljNzYxNjVmNDY3MDlhMDU5Y2ZhYzA5YTRkZjUiLCJwIjoiZ2l0aHViLWNvbS1KU1cifQ
GiteaMirror commented 2026-04-16 22:20:56 -05:00
Author
Owner
Copy Link

@pamperer562580892423 commented on GitHub (Feb 12, 2026):

Another user here.

Screenshots or Videos
Can't screenshot the app

In the app, go to Settings --> Other --> "Allow screen capture" and you can...

It would also be useful, if you copied & pasted everything from BW app --> Settings --> About --> Version in here (best: add it to your OP).

<!-- gh-comment-id:3891051066 --> @pamperer562580892423 commented on GitHub (Feb 12, 2026): Another user here. > Screenshots or Videos > Can't screenshot the app In the app, go to Settings --> Other --> "Allow screen capture" and you can... It would also be useful, if you copied & pasted everything from BW app --> Settings --> About --> Version in here (best: add it to your OP).
GiteaMirror commented 2026-04-16 22:20:57 -05:00
Author
Owner
Copy Link

@Krychaz commented on GitHub (Feb 12, 2026):

Hi there,

Are you able to replicate it if you create a new, dummy entry? As mentioned by @pamperer562580892423 it would be very useful to get a screen recording.

<!-- gh-comment-id:3891328246 --> @Krychaz commented on GitHub (Feb 12, 2026): Hi there, Are you able to replicate it if you create a new, dummy entry? As mentioned by @pamperer562580892423 it would be very useful to get a screen recording.
GiteaMirror commented 2026-04-16 22:20:57 -05:00
Author
Owner
Copy Link

@zotabee commented on GitHub (Feb 12, 2026):

@pamperer562580892423 Done, thanks.

@Krychaz Done. I tested a new dummy entry like I usually do, didn't reproduce. I'm going to try again. No, I can't reproduce with new entries so far. But my "ghost" TOTP entries are still there, with the same common fake code. It's life for 4-5 entries, all recently created in the last couple weeks max. On about 110 total TOTP entries.

<!-- gh-comment-id:3893240223 --> @zotabee commented on GitHub (Feb 12, 2026): @pamperer562580892423 Done, thanks. @Krychaz Done. I tested a new dummy entry like I usually do, didn't reproduce. I'm going to try again. No, I can't reproduce with new entries so far. But my "ghost" TOTP entries are still there, with the same common fake code. It's life for 4-5 entries, all recently created in the last couple weeks max. On about 110 total TOTP entries.
GiteaMirror commented 2026-04-16 22:20:58 -05:00
Author
Owner
Copy Link

@zotabee commented on GitHub (Feb 12, 2026):

All good on the web version and via the addon, no TOTP, as expected, chess dot com doesn't even have nor never supported TOTP.

Image
<!-- gh-comment-id:3893300961 --> @zotabee commented on GitHub (Feb 12, 2026): All good on the web version and via the addon, no TOTP, as expected, chess dot com doesn't even have nor never supported TOTP. <img width="1515" height="1117" alt="Image" src="https://github.com/user-attachments/assets/fdf12b4f-8774-4ad5-b966-fbe75a41fb6f" />
GiteaMirror commented 2026-04-16 22:20:59 -05:00
Author
Owner
Copy Link

@pamperer562580892423 commented on GitHub (Feb 12, 2026):

Ha, seems you could make good use of the screen capture function now. 😉

Maybe a bit silly, but just to be sure:

  • you only have one chess.com / Cloudflare - zone... / ... login item in your vault, correct?
  • and, therefore, for some of the screenshots you entered "View login", and from there (in the same login item), you entered "Edit login", correct?

Probably it doesn't mean anything, but I recognized that your Chess.com login item has time stamps that are one hour apart (Android app <--> web vault), so your devices are in different time zones?

Ah, and just FYI:

What server are you connecting to?
EU (well it seems it's US from the android app but I'm EU based)

Okay, you're EU based, but when the Android app shows "US", that should mean the BW account you're currently logged in with was created on the BW US cloud server (vault.bitwarden.com) - and not on the BW EU cloud server (vault.bitwarden.eu).

<!-- gh-comment-id:3893504321 --> @pamperer562580892423 commented on GitHub (Feb 12, 2026): Ha, seems you could make good use of the screen capture function now. 😉 Maybe a bit silly, but just to be sure: - you only have one chess.com / Cloudflare - zone... / ... login item in your vault, correct? - and, therefore, for some of the screenshots you entered "View login", and from there (in the same login item), you entered "Edit login", correct? Probably it doesn't mean anything, but I recognized that your Chess.com login item has time stamps that are one hour apart (Android app <--> web vault), so your devices are in different time zones? Ah, and just FYI: > What server are you connecting to? > EU (well it seems it's US from the android app but I'm EU based) Okay, you're EU based, but when the Android app shows "US", that _should_ mean the BW account you're currently logged in with was created on the BW US cloud server (`vault.bitwarden.com`) - and **not** on the BW EU cloud server (`vault.bitwarden.eu`).
GiteaMirror commented 2026-04-16 22:21:00 -05:00
Author
Owner
Copy Link

@zotabee commented on GitHub (Feb 13, 2026):

Ha, seems you could make good use of the screen capture function now. 😉

👍

Maybe a bit silly, but just to be sure:

* you only have one chess.com / Cloudflare - zone... / ... login item in your vault, correct?

* and, therefore, for some of the screenshots you entered "View login", and from there (in the same login item), you entered "Edit login", correct?

Yep, 100% affirmative, only entry of each, no duplicate. And yes, I enter "Edit" from the "View" screen to show there is no key set in those entries.

Amongst these bugged entries, they all show the same TOTP code. They take it from somewhere, somehow.

Probably it doesn't mean anything, but I recognized that your Chess.com login item has time stamps that are one hour apart (Android app <--> web vault), so your devices are in different time zones?

Yep, you are right, It's because I use a privacy focused browser that set me in a different timezone, UTC. That's why there is a difference between the browser and the app. Never had been an issue since I use BW though.

Ah, and just FYI:

What server are you connecting to?
EU (well it seems it's US from the android app but I'm EU based)

Okay, you're EU based, but when the Android app shows "US", that should mean the BW account you're currently logged in with was created on the BW US cloud server (vault.bitwarden.com) - and not on the BW EU cloud server (vault.bitwarden.eu).

Interesting, maybe because I use bitwarden.com.

<!-- gh-comment-id:3895985113 --> @zotabee commented on GitHub (Feb 13, 2026): > Ha, seems you could make good use of the screen capture function now. 😉 👍 > Maybe a bit silly, but just to be sure: > > * you only have one chess.com / Cloudflare - zone... / ... login item in your vault, correct? > > * and, therefore, for some of the screenshots you entered "View login", and from there (in the same login item), you entered "Edit login", correct? Yep, 100% affirmative, only entry of each, no duplicate. And yes, I enter "Edit" from the "View" screen to show there is no key set in those entries. Amongst these bugged entries, they all show the same TOTP code. They take it from somewhere, somehow. > Probably it doesn't mean anything, but I recognized that your Chess.com login item has time stamps that are one hour apart (Android app <--> web vault), so your devices are in different time zones? Yep, you are right, It's because I use a privacy focused browser that set me in a different timezone, UTC. That's why there is a difference between the browser and the app. Never had been an issue since I use BW though. > Ah, and just FYI: > > > What server are you connecting to? > > EU (well it seems it's US from the android app but I'm EU based) > > Okay, you're EU based, but when the Android app shows "US", that _should_ mean the BW account you're currently logged in with was created on the BW US cloud server (`vault.bitwarden.com`) - and **not** on the BW EU cloud server (`vault.bitwarden.eu`). Interesting, maybe because I use bitwarden.com.
GiteaMirror commented 2026-04-16 22:21:01 -05:00
Author
Owner
Copy Link

@pamperer562580892423 commented on GitHub (Feb 15, 2026):

There now is another report about this issue: https://community.bitwarden.com/t/bitwarden-created-a-bogus-totp-for-google-for-nonprofit-users/93904

<!-- gh-comment-id:3903075638 --> @pamperer562580892423 commented on GitHub (Feb 15, 2026): There now is another report about this issue: https://community.bitwarden.com/t/bitwarden-created-a-bogus-totp-for-google-for-nonprofit-users/93904
GiteaMirror commented 2026-04-16 22:21:01 -05:00
Author
Owner
Copy Link

@cyfra80 commented on GitHub (Mar 24, 2026):

I have the same issue.
When I create a item on the website or in the extension, a 6-digit TOTP code appears in the Android app.

The only workaround is to go to the edit screen in the Android app and delete the empty “authentication key” field

<!-- gh-comment-id:4120195201 --> @cyfra80 commented on GitHub (Mar 24, 2026): I have the same issue. When I create a item on the website or in the extension, a 6-digit TOTP code appears in the Android app. The only workaround is to go to the edit screen in the Android app and delete the empty “authentication key” field
GiteaMirror commented 2026-04-16 22:21:02 -05:00
Author
Owner
Copy Link

@TheRealOwnerOfTheDimmsdaleDimmadome commented on GitHub (Mar 25, 2026):

Same issue here on Android 13. Have to fix it after every new entry.

<!-- gh-comment-id:4125339591 --> @TheRealOwnerOfTheDimmsdaleDimmadome commented on GitHub (Mar 25, 2026): Same issue here on Android 13. Have to fix it after every new entry.
GiteaMirror commented 2026-04-16 22:21:02 -05:00
Author
Owner
Copy Link

@weirdcrap commented on GitHub (Mar 25, 2026):

This just appeared for the first time for me as well. I created an account on backerkit and saved my info in the browser extension. I never setup MFA and the secret field is empty yet the Android app now has a phantom TOTP code for that entry.

<!-- gh-comment-id:4125430340 --> @weirdcrap commented on GitHub (Mar 25, 2026): This just appeared for the first time for me as well. I created an account on backerkit and saved my info in the browser extension. I never setup MFA and the secret field is empty yet the Android app now has a phantom TOTP code for that entry.
GiteaMirror commented 2026-04-16 22:21:03 -05:00
Author
Owner
Copy Link

@florian101010 commented on GitHub (Mar 27, 2026):

Have the same problem on iOS app. I just saved a passkey (nothing else) into a new entry, now its showing a TOTP entry for this...

<!-- gh-comment-id:4143231049 --> @florian101010 commented on GitHub (Mar 27, 2026): Have the same problem on iOS app. I just saved a passkey (nothing else) into a new entry, now its showing a TOTP entry for this...
GiteaMirror commented 2026-04-16 22:21:03 -05:00
Author
Owner
Copy Link

@dclaar commented on GitHub (Apr 2, 2026):

I have a bunch of email passwords for our domain users. (This is https://community.bitwarden.com/t/bitwarden-creates-a-bogus-totp-code/93904). So, username1@domain, username2@domain, etc.

These all have the same bogus TOTP. They do not show up as having a code in the authenticator app.

Since I wrote that report, I added another TOTP via the authenticator app, using a Google authenticator QR code.
It shows up 3 times in the authenticator app: 2 times under "LOCAL CODES", and 1 time under my bitwarden account. All 3 have the same TOTP. (This seems to happen for all TOTPs added via Google authenticator QR codes: The vault one is probably WAI, since I copied it to the vault).

This TOTP spawned another bogus TOTP:
I had 2 entries: "Synology Disk station" and "Synology Disk Station Time Machine". The authenticator app asked which one I wanted to use. I picked "Synology Disk station", and that has the correct TOTP; however, the other entry has the same bogus TOTP as the emails.

Deleting them manually appears to work, and--so far--they haven't come back, but I haven't added another @domain entry, so the jury's still out....

<!-- gh-comment-id:4174242892 --> @dclaar commented on GitHub (Apr 2, 2026): I have a bunch of email passwords for our domain users. (This is https://community.bitwarden.com/t/bitwarden-creates-a-bogus-totp-code/93904). So, username1@domain, username2@domain, etc. These all have the same bogus TOTP. They do not show up as having a code in the authenticator app. Since I wrote that report, I added another TOTP via the authenticator app, using a Google authenticator QR code. It shows up 3 times in the authenticator app: 2 times under "LOCAL CODES", and 1 time under my bitwarden account. All 3 have the same TOTP. (This seems to happen for all TOTPs added via Google authenticator QR codes: The vault one is probably WAI, since I _copied_ it to the vault). This TOTP spawned another bogus TOTP: I had 2 entries: "Synology Disk station" and "Synology Disk Station Time Machine". The authenticator app asked which one I wanted to use. I picked "Synology Disk station", and that has the correct TOTP; however, the other entry has the same bogus TOTP as the emails. Deleting them manually appears to work, and--so far--they haven't come back, but I haven't added another @domain entry, so the jury's still out....
GiteaMirror commented 2026-04-16 22:21:04 -05:00
Author
Owner
Copy Link

@richtesoriero commented on GitHub (Apr 10, 2026):

I have the same problem on the iOS app. Each new login entry adds a bogus TOTP. Just wasted 90 minutes on this after upgrading my account to premium to "clean up" my shared accounts. Disappointing.

<!-- gh-comment-id:4224556533 --> @richtesoriero commented on GitHub (Apr 10, 2026): I have the same problem on the iOS app. Each new login entry adds a bogus TOTP. Just wasted 90 minutes on this after upgrading my account to premium to "clean up" my shared accounts. Disappointing.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
app:authenticator
app:password-manager
bug
bug-passkey
customer-support
duplicate
enhancement
good first issue
help wanted
needs-reply
needs-response
pull-request
Mirrored from GitHub Pull Request
 question
No Label app:password-manager bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/android#21728
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?