Applied SecurityKey to Passkey fixes from @zUnixorn
Fix Webauthn/Passkey 2FA migration issues
Because the webauthn-rs v0.3 crate did not know or store new flags currently used in v0.5, some verifications failed.
This mainly failed because of a check if a key was backuped or not, and if it was allowed to do so.
Most hardware keys like YubiKey's do not have this flag enabled and can't be duplicated or faked via software.
Since the rise of Passkey's, like Bitwarden's own implementation, and other platforms like Android, and Apple use Software keys which are shared between devices, they set these backup flags to true. This broke the login attempts, because the default during the migration was false, and cause an error during validation.
This PR checks for the flags during the response/verification step, and if these flags are true, then search for the stored key, adjust it's value, and also update the current challenge state to match, to prevent the first login attempt to fail.
This should not cause any issue, since the credential-id is checked and matched, and only updated when needed.
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.
## 📋 Pull Request Information
**Original PR:** https://github.com/dani-garcia/vaultwarden/pull/6190
**Author:** [@BlackDex](https://github.com/BlackDex)
**Created:** 8/16/2025
**Status:** ✅ Merged
**Merged:** 8/25/2025
**Merged by:** [@dani-garcia](https://github.com/dani-garcia)
**Base:** `main` ← **Head:** `webauthn-fixes`
---
### 📝 Commits (3)
- [`c9070cf`](https://github.com/dani-garcia/vaultwarden/commit/c9070cf4626d5bcf39c8874b7e92f9e3ff2dbdb7) Apply Passkey fixes from zUnixorn
- [`d2632a3`](https://github.com/dani-garcia/vaultwarden/commit/d2632a3399554702c67b97e26e1774e9c166f75a) Fix Webauthn/Passkey 2FA migration issues
- [`5d0ade4`](https://github.com/dani-garcia/vaultwarden/commit/5d0ade4db5b905d762cdff8292b0db80aa9f9664) Fix comments
### 📊 Changes
**2 files changed** (+114 additions, -17 deletions)
<details>
<summary>View changed files</summary>
📝 `Cargo.toml` (+1 -2)
📝 `src/api/core/two_factor/webauthn.rs` (+113 -15)
</details>
### 📄 Description
- Applied SecurityKey to Passkey fixes from @zUnixorn
### Fix Webauthn/Passkey 2FA migration issues
Because the webauthn-rs v0.3 crate did not know or store new flags currently used in v0.5, some verifications failed.
This mainly failed because of a check if a key was backuped or not, and if it was allowed to do so.
Most hardware keys like YubiKey's do not have this flag enabled and can't be duplicated or faked via software.
Since the rise of Passkey's, like Bitwarden's own implementation, and other platforms like Android, and Apple use Software keys which are shared between devices, they set these backup flags to true. This broke the login attempts, because the default during the migration was `false`, and cause an error during validation.
This PR checks for the flags during the response/verification step, and if these flags are `true`, then search for the stored key, adjust it's value, and also update the current challenge state to match, to prevent the first login attempt to fail.
This should not cause any issue, since the credential-id is checked and matched, and only updated when needed.
Fixes #6154
---
<sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
📋 Pull Request Information
Original PR: https://github.com/dani-garcia/vaultwarden/pull/6190
Author: @BlackDex
Created: 8/16/2025
Status: ✅ Merged
Merged: 8/25/2025
Merged by: @dani-garcia
Base:
main← Head:webauthn-fixes📝 Commits (3)
c9070cfApply Passkey fixes from zUnixornd2632a3Fix Webauthn/Passkey 2FA migration issues5d0ade4Fix comments📊 Changes
2 files changed (+114 additions, -17 deletions)
View changed files
📝
Cargo.toml(+1 -2)📝
src/api/core/two_factor/webauthn.rs(+113 -15)📄 Description
Fix Webauthn/Passkey 2FA migration issues
Because the webauthn-rs v0.3 crate did not know or store new flags currently used in v0.5, some verifications failed.
This mainly failed because of a check if a key was backuped or not, and if it was allowed to do so.
Most hardware keys like YubiKey's do not have this flag enabled and can't be duplicated or faked via software.
Since the rise of Passkey's, like Bitwarden's own implementation, and other platforms like Android, and Apple use Software keys which are shared between devices, they set these backup flags to true. This broke the login attempts, because the default during the migration was
false, and cause an error during validation.This PR checks for the flags during the response/verification step, and if these flags are
true, then search for the stored key, adjust it's value, and also update the current challenge state to match, to prevent the first login attempt to fail.This should not cause any issue, since the credential-id is checked and matched, and only updated when needed.
Fixes #6154
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.