github-starred/android
2
0
Fork 0
mirror of https://github.com/bitwarden/android.git synced 2026-05-11 10:54:26 -05:00
Code Issues 1.1k Packages Projects Releases 124 Wiki Activity

[GH-ISSUE #926] TOTP working without premium (new TOPT input bypass using app) #37985

New Issue
Closed
opened 2026-04-23 15:47:12 -05:00 by GiteaMirror · 1 comment
GiteaMirror commented 2026-04-23 15:47:12 -05:00
Owner
Copy Link

Originally created by @VenomrushCT on GitHub (May 26, 2020).
Original GitHub issue: https://github.com/bitwarden/android/issues/926

A non-premium user can use TOTP feature.

Steps to reproduce:

  1. Login using a non-premium Bitwarden account
  2. Using web browser, go to a website that requires OTP and add this website new entry without OTP
  3. Login using a non-premium Bitwarden account on mobile app (iOS 13.4.1 Bitwarden v2.3.1)
  4. On mobile app, find website entry, open the entry and click Edit
  5. Able to see "Authenticator Key (TOTP)" field and Camera Icon, user can proceed to scan QR code and save entry with TOTP
  6. Using web browser, go back the website
  7. On the website, right click anywhere on the page and choose Bitwarden in the menu (Bitwarden extension v1.43.4)
  8. Able to see and click Copy Verification Code
  9. Focus cursor on OTP field on the website and Paste, able to paste the code into OTP field on the website

Expected behaviour:

  1. "Authenticator Key (TOTP)" field should not be available in mobile app (iOS and Android) when editing a Login entry as non-premium user
  2. "Copy Verification Code" option should be not available in any web browsers as non-premium user
Originally created by @VenomrushCT on GitHub (May 26, 2020). Original GitHub issue: https://github.com/bitwarden/android/issues/926 A non-premium user can use TOTP feature. Steps to reproduce: 1. Login using a non-premium Bitwarden account 2. Using web browser, go to a website that requires OTP and add this website new entry without OTP 3. Login using a non-premium Bitwarden account on mobile app (iOS 13.4.1 Bitwarden v2.3.1) 4. On mobile app, find website entry, open the entry and click Edit 5. **Able to see "Authenticator Key (TOTP)" field and Camera Icon, user can proceed to scan QR code and save entry with TOTP** 6. Using web browser, go back the website 7. On the website, right click anywhere on the page and choose Bitwarden in the menu (Bitwarden extension v1.43.4) 8. Able to see and click **Copy Verification Code** 9. Focus cursor on OTP field on the website and Paste, able to **paste the code into OTP field on the website** Expected behaviour: 1. "Authenticator Key (TOTP)" field should not be available in mobile app (iOS and Android) when editing a Login entry as non-premium user 2. "Copy Verification Code" option should be not available in any web browsers as non-premium user
GiteaMirror commented 2026-04-23 15:47:13 -05:00
Author
Owner
Copy Link

@kspearrin commented on GitHub (May 26, 2020):

Using the camera option is allowed when not premium, but the context menu option in the browser extension should be hidden. Fixed with https://github.com/bitwarden/browser/pull/1252

<!-- gh-comment-id:634208924 --> @kspearrin commented on GitHub (May 26, 2020): Using the camera option is allowed when not premium, but the context menu option in the browser extension should be hidden. Fixed with https://github.com/bitwarden/browser/pull/1252
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
app:authenticator
app:password-manager
bug
bug-passkey
customer-support
duplicate
enhancement
good first issue
help wanted
needs-reply
needs-response
pull-request
Mirrored from GitHub Pull Request
 question
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/android#37985
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?