[GH-ISSUE #3334] FIDO2 security key: Invalid verification code #65725

Closed
opened 2026-05-14 07:19:03 -05:00 by GiteaMirror · 5 comments
Owner

Originally created by @mderazon on GitHub (Jun 21, 2024).
Original GitHub issue: https://github.com/bitwarden/android/issues/3334

Steps To Reproduce

  1. Sign in, enter username and master password
  2. See the webauthn screen
  3. Authenticate with webauthn (will open a browser window)
  4. Select a USB / NFC key (in my case I plugged in my USB security key directly into the phone)
  5. Approve the key (most keys have a button or something similar)
  6. App opens again and shows the error dialog

Expected Result

To be logged in

Actual Result

Dialog that says:

And error has occurred.

Invalid verification code

Screenshots or Videos

https://github.com/bitwarden/android/assets/717076/4a660a6f-ca0a-4bea-aa2d-8bd9f255aeaf

image

Additional Context

Build Version

2024.6.1 (11139)

Environment Details

  • Pixel 7, Android 15 Beta
  • Default browser is Firefox Android

Issue Tracking Info

  • I understand that work is tracked outside of Github. A PR will be linked to this issue should one be opened to address it, but Bitwarden doesn't use fields like "assigned", "milestone", or "project" to track progress.
Originally created by @mderazon on GitHub (Jun 21, 2024). Original GitHub issue: https://github.com/bitwarden/android/issues/3334 ### Steps To Reproduce 1. Sign in, enter username and master password 2. See the webauthn screen 3. Authenticate with webauthn (will open a browser window) 4. Select a USB / NFC key (in my case I plugged in my USB security key directly into the phone) 5. Approve the key (most keys have a button or something similar) 6. App opens again and shows the error dialog ### Expected Result To be logged in ### Actual Result Dialog that says: > #### And error has occurred. > Invalid verification code ### Screenshots or Videos https://github.com/bitwarden/android/assets/717076/4a660a6f-ca0a-4bea-aa2d-8bd9f255aeaf ![image](https://github.com/bitwarden/android/assets/717076/a7452567-6898-49d7-93b8-df11ad25b69a) ### Additional Context - Using Bitwarden cloud - [FEITIAN ePass FIDO2 FIDO U2F key](https://shop.ftsafe.us/products/k9-piv) ### Build Version 2024.6.1 (11139) ### Environment Details - Pixel 7, Android 15 Beta - Default browser is Firefox Android ### Issue Tracking Info - [x] I understand that work is tracked outside of Github. A PR will be linked to this issue should one be opened to address it, but Bitwarden doesn't use fields like "assigned", "milestone", or "project" to track progress.
GiteaMirror added the bug label 2026-05-14 07:19:03 -05:00
Author
Owner

@NovaSilentium commented on GitHub (Jun 24, 2024):

Hi there,

I attempted to reproduce your issue and was unable to do so.

We use GitHub issues as a place to track bugs and other development related issues. If your issue persists, please write us back using our “Contact support” form located on our Help Center (https://bitwarden.com/help/).

You can include a link to this issue in the message content.

Alternatively, you can also search for an answer in our help documentation or get help from other Bitwarden users on our community forums (https://community.bitwarden.com/c/support/).

The issue here will be closed.

<!-- gh-comment-id:2185860435 --> @NovaSilentium commented on GitHub (Jun 24, 2024): Hi there, I attempted to reproduce your issue and was unable to do so. We use GitHub issues as a place to track bugs and other development related issues. If your issue persists, please write us back using our “Contact support” form located on our Help Center (https://bitwarden.com/help/). You can include a link to this issue in the message content. Alternatively, you can also search for an answer in our help documentation or get help from other Bitwarden users on our community forums (https://community.bitwarden.com/c/support/). The issue here will be closed.
Author
Owner

@mderazon commented on GitHub (Jun 24, 2024):

@NovaSilentium what is the default browser you tried to reproduce this with ?

<!-- gh-comment-id:2185865438 --> @mderazon commented on GitHub (Jun 24, 2024): @NovaSilentium what is the default browser you tried to reproduce this with ?
Author
Owner

@Enduriel commented on GitHub (Aug 24, 2024):

I can confirm I ran into the exact same issue with version: 2024.8.0 (18985), the issue seems to be Firefox, switching to chrome as the default browser fixed the issue for me. The rest of my environment is very different from OP, if you are unable to reproduce this issue with Firefox being the default app I can post all my details or make a new issue but it seems to me like the problem is an incompatibility with Firefox mobile.

<!-- gh-comment-id:2308560950 --> @Enduriel commented on GitHub (Aug 24, 2024): I can confirm I ran into the exact same issue with version: 2024.8.0 (18985), the issue seems to be Firefox, switching to chrome as the default browser fixed the issue for me. The rest of my environment is very different from OP, if you are unable to reproduce this issue with Firefox being the default app I can post all my details or make a new issue but it seems to me like the problem is an incompatibility with Firefox mobile.
Author
Owner

@NGroens commented on GitHub (Aug 26, 2024):

I use Google Chrome as my default browser and can confirm that I also have this issue.

<!-- gh-comment-id:2309351699 --> @NGroens commented on GitHub (Aug 26, 2024): I use Google Chrome as my default browser and can confirm that I also have this issue.
Author
Owner

@charlesneimog commented on GitHub (Sep 3, 2024):

Hi, same for me. This start to happen after I change KDF iterations to 600.000. Important to note that, on my others devices such as notebook, computers, my 2FA code is valid.

I already try to delete my android app data. turn off the 2FA via apps and turn it on. Turn both off and use the email verification.

For all 2FA I have invalid code on andoird device.

The solution is to turn off the 2FA, do the login and turn it on again.

<!-- gh-comment-id:2326845202 --> @charlesneimog commented on GitHub (Sep 3, 2024): Hi, same for me. This start to happen after I change `KDF iterations` to `600.000`. Important to note that, on my others devices such as notebook, computers, my 2FA code is valid. I already try to delete my android app data. turn off the 2FA via apps and turn it on. Turn both off and use the email verification. For all 2FA I have invalid code on andoird device. The solution is to turn off the 2FA, do the login and turn it on again.
Sign in to join this conversation.
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/android#65725