github-starred/android
2
0
Fork 0
mirror of https://github.com/bitwarden/android.git synced 2026-03-16 08:33:59 -05:00
Code Issues 144 Packages Projects Releases 116 Wiki Activity

Password bypass with split screen #230

New Issue
Closed
opened 2025-11-07 08:31:49 -06:00 by GiteaMirror · 2 comments
GiteaMirror commented 2025-11-07 08:31:49 -06:00
Owner
Copy Link

Originally created by @atomheartother on GitHub (Jun 3, 2018).

I would report this on HackerOne but you guys asked not to report flaws which require physical access to a device, so here I am.

What

I found a way to bypass the password/fingerprint screen on Bitwarden Android, accessing the vault without authentication. I have not tested this on an iPhone. I have tested it on Android, and can reproduce this bug 100% of the time on the two devices I've tried it on.

How

Steps to reproduce:

  • Lock your vault
  • Find an app with a login form, Bitwarden pops a notification telling you it can try to auto-fill
  • Click the notification, you're taken to a "verify password" screen (or enter fingerprint)
  • Enter split-screen mode (the button for this depends on your device). In most of my tests, at this point, the vault is unlocked. If it isn't:
  • Expand the bitwarden screen to take up the whole screen again. The vault unlocks.

Tested on a OnePlus 3 in password mode. I also tested this on a Nokia 6 in fingerprint mode, and it worked when I pressed "Back" on bitwarden's login screen while in split screen mode, unlocking the vault.

Details

I've tried to make this work without auto-fill (just opening Bitwarden and doing split screen) but it's finnicky. It works sometimes, but only if I previously unlocked the vault using the autofill method. If i close the bitwarden app and restart it, it doesn't work directly. The autofill method always works.

Originally created by @atomheartother on GitHub (Jun 3, 2018). I would report this on HackerOne but you guys asked not to report flaws which require physical access to a device, so here I am. # What I found a way to bypass the password/fingerprint screen on Bitwarden Android, accessing the vault without authentication. I have not tested this on an iPhone. I have tested it on Android, and can reproduce this bug 100% of the time on the two devices I've tried it on. # How Steps to reproduce: - Lock your vault - Find an app with a login form, Bitwarden pops a notification telling you it can try to auto-fill - Click the notification, you're taken to a "verify password" screen (or enter fingerprint) - Enter split-screen mode (the button for this depends on your device). In most of my tests, at this point, the vault is unlocked. If it isn't: - Expand the bitwarden screen to take up the whole screen again. The vault unlocks. Tested on a OnePlus 3 in password mode. I also tested this on a Nokia 6 in fingerprint mode, and it worked when I pressed "Back" on bitwarden's login screen while in split screen mode, unlocking the vault. # Details I've tried to make this work without auto-fill (just opening Bitwarden and doing split screen) but it's finnicky. It works sometimes, but only if I previously unlocked the vault using the autofill method. If i close the bitwarden app and restart it, it doesn't work directly. The autofill method always works.
GiteaMirror commented 2025-11-07 08:31:49 -06:00
Author
Owner
Copy Link

@kspearrin commented on GitHub (Jun 3, 2018):

@atomheartother Thanks for the report. I was able to reproduce the issue.

@kspearrin commented on GitHub (Jun 3, 2018): @atomheartother Thanks for the report. I was able to reproduce the issue.
GiteaMirror commented 2025-11-07 08:31:50 -06:00
Author
Owner
Copy Link

@kspearrin commented on GitHub (Jun 4, 2018):

This is fixed in the latest play store beta. Can you confirm?

@kspearrin commented on GitHub (Jun 4, 2018): This is fixed in the latest play store beta. Can you confirm?
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
app:authenticator
app:password-manager
bug
bug-passkey
customer-support
duplicate
enhancement
good first issue
help wanted
needs-reply
needs-response
pull-request
Mirrored from GitHub Pull Request
 question
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/android#230
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?