github-starred/android
2
0
Fork 0
mirror of https://github.com/bitwarden/android.git synced 2026-06-10 00:28:29 -05:00
Code Issues 2.2k Packages Projects Releases 127 Wiki Activity

[GH-ISSUE #6263] [BWA-212] Account Removed from Linked Bitwarden App Still Shows Entries In Authenticator #66221

New Issue
Closed
opened 2026-05-14 08:06:25 -05:00 by GiteaMirror · 8 comments
GiteaMirror commented 2026-05-14 08:06:25 -05:00
Owner
Copy Link

Originally created by @PXAbstraction on GitHub (Dec 12, 2025).
Original GitHub issue: https://github.com/bitwarden/android/issues/6263

Steps To Reproduce

  1. Remove an account from the main Bitwarden Android app.
  2. Launch Authenticator.

Expected Result

That the MFA codes from the removed linked account would be gone.

Actual Result

The MFA codes from the removed linked account are still present. I also don't appear to be able to remove the linked account without resetting the Authenticator app entirely.

Screenshots or Videos

No response

Additional Context

This is a major security flaw in the Authenticator application.

I have my own Bitwarden account and also had another Bitwarden Enterprise account links from an employer I am no longer at. I was locked out of that account and removed it from the main app, however ALL of the linked MFA tokens still appear in Authenticator and I also can't delete them. It seems the only way to do that is to reset the app entirely. I can and will do that, however if I were a bad actor who had some of the passwords linked to these tokens, I could still use them to login to account I shouldn't.

I don't understand how a flaw like this got through QA, but Authenticator MUST check for linked account removals and pull their data.

Build Version

2025.11.1

What server are you connecting to?

EU

Self-host Server Version

No response

Environment Details

Pixel 9
Android 16 (Build number BP3A.251105.015)

Issue Tracking Info

  • I understand that work is tracked outside of Github. A PR will be linked to this issue should one be opened to address it, but Bitwarden doesn't use fields like "assigned", "milestone", or "project" to track progress.
Originally created by @PXAbstraction on GitHub (Dec 12, 2025). Original GitHub issue: https://github.com/bitwarden/android/issues/6263 ### Steps To Reproduce 1. Remove an account from the main Bitwarden Android app. 2. Launch Authenticator. ### Expected Result That the MFA codes from the removed linked account would be gone. ### Actual Result The MFA codes from the removed linked account are still present. I also don't appear to be able to remove the linked account without resetting the Authenticator app entirely. ### Screenshots or Videos _No response_ ### Additional Context This is a **major** security flaw in the Authenticator application. I have my own Bitwarden account and also had another Bitwarden Enterprise account links from an employer I am no longer at. I was locked out of that account and removed it from the main app, however ALL of the linked MFA tokens still appear in Authenticator and I also can't delete them. It seems the only way to do that is to reset the app entirely. I can and will do that, however if I were a bad actor who had some of the passwords linked to these tokens, I could still use them to login to account I shouldn't. I don't understand how a flaw like this got through QA, but Authenticator MUST check for linked account removals and pull their data. ### Build Version 2025.11.1 ### What server are you connecting to? EU ### Self-host Server Version _No response_ ### Environment Details Pixel 9 Android 16 (Build number BP3A.251105.015) ### Issue Tracking Info - [x] I understand that work is tracked outside of Github. A PR will be linked to this issue should one be opened to address it, but Bitwarden doesn't use fields like "assigned", "milestone", or "project" to track progress.
GiteaMirror added the bugapp:authenticator labels 2026-05-14 08:06:26 -05:00
GiteaMirror commented 2026-05-14 08:06:29 -05:00
Author
Owner
Copy Link

@bitwarden-bot commented on GitHub (Dec 12, 2025):

Thank you for your report! We've added this to our internal board for review.
ID: BWA-212

<!-- gh-comment-id:3647267936 --> @bitwarden-bot commented on GitHub (Dec 12, 2025): Thank you for your report! We've added this to our internal board for review. ID: [BWA-212](https://bitwarden.atlassian.net/browse/BWA-212) [BWA-212]: https://bitwarden.atlassian.net/browse/BWA-212?atlOrigin=eyJpIjoiNWRkNTljNzYxNjVmNDY3MDlhMDU5Y2ZhYzA5YTRkZjUiLCJwIjoiZ2l0aHViLWNvbS1KU1cifQ
GiteaMirror commented 2026-05-14 08:06:29 -05:00
Author
Owner
Copy Link

@Neonwarden commented on GitHub (Dec 12, 2025):

Hi there,

This issue has been escalated for further investigation. If you have more information that can help us, please add it below.

Thanks!

<!-- gh-comment-id:3647639731 --> @Neonwarden commented on GitHub (Dec 12, 2025): Hi there, This issue has been escalated for further investigation. If you have more information that can help us, please add it below. Thanks!
GiteaMirror commented 2026-05-14 08:06:30 -05:00
Author
Owner
Copy Link

@PXAbstraction commented on GitHub (Dec 12, 2025):

Is there anything else beyond what I've reported above that could be helpful? I'm happy to provide whatever can assist.

<!-- gh-comment-id:3647648592 --> @PXAbstraction commented on GitHub (Dec 12, 2025): Is there anything else beyond what I've reported above that could be helpful? I'm happy to provide whatever can assist.
GiteaMirror commented 2026-05-14 08:06:31 -05:00
Author
Owner
Copy Link

@pamperer562580892423 commented on GitHub (Dec 14, 2025):

Hmmm... I cannot quite reproduce this.

When I follow your steps, i.e. removing the login item in the Android BW mobile app (2025.12.0), then the authenticator app (2025.11.1) updates they "synced items". - But when I remove the login item in e.g. the web vault, and then open the authenticator app, then it still shows the synced (but deleted) login item.

However, as soon as I unlock the mobile app (with the syncing account), then the authenticator app gets updated and doesn't show the deleted login item.

I now deleted a test item in the web vault, try not to open the Android mobile app, and if I remember it tomorrow, I'll report back if the authenticator app then still shows the synced but deleted login item....

Update: So, just about 8 hours later, the synced but deleted login item is indeed still shown in the authenticator app (I didn't unlock the "syncing" account on the mobile app since I deleted the login item via the web vault). - And I think, I could imagine now, that if I would delete that account in the mobile app, that it could be that the authenticator app shows the synced codes forever... Hmm, though, I just logged out with that account on the mobile app (without unlocking it), and the authenticator app now doesn't show me the synced codes anymore at all.

<!-- gh-comment-id:3650129852 --> @pamperer562580892423 commented on GitHub (Dec 14, 2025): Hmmm... I cannot quite reproduce this. When I follow your steps, i.e. removing the login item in the Android BW mobile app (2025.12.0), then the authenticator app (2025.11.1) updates they "synced items". - But when I remove the login item in e.g. the web vault, and then open the authenticator app, then it still shows the synced (but deleted) login item. However, as soon as I unlock the mobile app (with the syncing account), then the authenticator app gets updated and doesn't show the deleted login item. I now deleted a test item in the web vault, try not to open the Android mobile app, and if I remember it tomorrow, I'll report back if the authenticator app then still shows the synced but deleted login item.... **Update:** So, just about 8 hours later, the synced but deleted login item is indeed still shown in the authenticator app (I didn't unlock the "syncing" account on the mobile app since I deleted the login item via the web vault). - And I think, I could imagine now, that if I would delete that account in the mobile app, that it could be that the authenticator app shows the synced codes forever... Hmm, though, I just logged out with that account on the mobile app (without unlocking it), and the authenticator app now **doesn't** show me the synced codes anymore at all.
GiteaMirror commented 2026-05-14 08:06:31 -05:00
Author
Owner
Copy Link

@PXAbstraction commented on GitHub (Dec 14, 2025):

Hey there.

So, I should clarify because I think I wasn't clear enough. My report didn't concern removing an individual items from a linked Bitwarden app and having it stick around in Authenticator. My issue was that when you remove an entire account from a linked app, everything from that account stays put in the Authenticator app and can't be removed. So, way worse than a single credential. :)

Hope this helps.

<!-- gh-comment-id:3651921046 --> @PXAbstraction commented on GitHub (Dec 14, 2025): Hey there. So, I should clarify because I think I wasn't clear enough. My report didn't concern removing an individual items from a linked Bitwarden app and having it stick around in Authenticator. My issue was that when you remove an entire _account_ from a linked app, _everything_ from that account stays put in the Authenticator app and can't be removed. So, way worse than a single credential. :) Hope this helps.
GiteaMirror commented 2026-05-14 08:06:32 -05:00
Author
Owner
Copy Link

@pamperer562580892423 commented on GitHub (Dec 14, 2025):

@PXAbstraction:

  1. Remove an account from the main Bitwarden Android app.

Where did you remove it exactly?
And how did you remove it?
And is this account still shown "there"?

<!-- gh-comment-id:3651947465 --> @pamperer562580892423 commented on GitHub (Dec 14, 2025): @PXAbstraction: > 1. Remove an account from the main Bitwarden Android app. Where did you remove it exactly? And how did you remove it? And is this account still shown "there"?
GiteaMirror commented 2026-05-14 08:06:33 -05:00
Author
Owner
Copy Link

@PXAbstraction commented on GitHub (Dec 14, 2025):

So, I just did some more testing and I think this is now a non-issue. I don't know why, but when I launched the main Bitwarden app, my former employer's account was back. I removed it, closed and relaunched the app and it was there again. I then cleared all the app data, logged in with only my personal account and now the corporate account is completely gone and the MFA tokens from it are no longer showing in the Authenticator app.

Not sure what happened there, but it seems to have resolved it. I'm guessing it was something that glitched on my device as no one else has reported this issue with accounts reappearing. So I think it's all good now.

Thanks for your help.

<!-- gh-comment-id:3651970155 --> @PXAbstraction commented on GitHub (Dec 14, 2025): So, I just did some more testing and I think this is now a non-issue. I don't know why, but when I launched the main Bitwarden app, my former employer's account was back. I removed it, closed and relaunched the app and it was there again. I then cleared all the app data, logged in with only my personal account and now the corporate account is completely gone and the MFA tokens from it are no longer showing in the Authenticator app. Not sure what happened there, but it seems to have resolved it. I'm guessing it was something that glitched on my device as no one else has reported this issue with accounts reappearing. So I think it's all good now. Thanks for your help.
GiteaMirror commented 2026-05-14 08:06:33 -05:00
Author
Owner
Copy Link

@pamperer562580892423 commented on GitHub (Dec 14, 2025):

@Neonwarden Though this is resolved now for OP, I think the authenticator app only syncing data when the mobile password manager app gets unlocked is at least "unfortunate" - if not a bug. (as the synced authenticator doesn't get "updated" automatically when one does make changes in their vault on other BW clients - but the mobile app should sync automatically with these changes and therefore update the syncing data on the authenticator app as well, I think)

(also see my previous post above for more details on that)

<!-- gh-comment-id:3651987701 --> @pamperer562580892423 commented on GitHub (Dec 14, 2025): @Neonwarden Though this is resolved now for OP, I think the authenticator app only syncing data when the mobile password manager app gets unlocked is at least "unfortunate" - if not a bug. (as the synced authenticator doesn't get "updated" automatically when one does make changes in their vault on other BW clients - but the mobile app should sync automatically with these changes and therefore update the syncing data on the authenticator app as well, I think) (also see my [previous post](https://github.com/bitwarden/android/issues/6263#issuecomment-3650129852) above for more details on that)
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
app:authenticator
app:password-manager
bug
bug-passkey
customer-support
duplicate
enhancement
good first issue
help wanted
needs-reply
needs-response
pull-request
Mirrored from GitHub Pull Request
 question
No Label app:authenticator bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/android#66221
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?