starred/vaultwarden
1
0
Fork 0
mirror of https://github.com/dani-garcia/vaultwarden.git synced 2026-02-05 08:39:46 +03:00
Code Issues 32 Packages Projects Releases 10 Wiki Activity

Chrome extension bypasses 2fa ?! #1011

New Issue
Closed
opened 2026-02-04 23:37:08 +03:00 by OVERLORD · 2 comments
OVERLORD commented 2026-02-04 23:37:08 +03:00
Owner
Copy Link

Originally created by @H4R0 on GitHub (Apr 14, 2021).

Subject of the issue

Chrome Bitwarden extension is not asking for 2fa method on login anymore.

This started 2 days ago after I upgraded to bitwardenrs/server:latest

The Desktop Client as well as the Web Vault is asking for 2fa method.

How can 2fa even be bypassed ?! The Extension is LOGGED OUT not LOCKED !

Steps to reproduce

Setup 2fa with email or anything else and login using the chrome extension.

Expected behaviour

Client should ask for 2fa

Actual behaviour

Client logs in without asking for 2fa

Troubleshooting data

The container log differs for both logins.

Chrome Extension not asking for 2fa:

[2021-04-14 15:37:44.171][request][INFO] POST /api/accounts/prelogin
[2021-04-14 15:37:44.183][response][INFO] POST /api/accounts/prelogin (prelogin) => 200 OK
[2021-04-14 15:37:44.252][request][INFO] POST /identity/connect/token
[2021-04-14 15:37:44.378][bitwarden_rs::api::identity][INFO] User user@example.org logged in successfully. IP: 192.168.1.xxx
[2021-04-14 15:37:44.379][response][INFO] POST /identity/connect/token (login) => 200 OK
[2021-04-14 15:37:44.435][request][INFO] GET /api/sync
[2021-04-14 15:37:44.484][response][INFO] GET /api/sync?<data..> (sync) => 200 OK
[2021-04-14 15:37:44.492][parity_ws::io][INFO] Accepted a new tcp connection from 192.168.1.xxx:56006.

Desktop Client asking for 2fa:

[2021-04-14 15:38:11.099][request][INFO] POST /api/accounts/prelogin
[2021-04-14 15:38:11.101][response][INFO] POST /api/accounts/prelogin (prelogin) => 200 OK
[2021-04-14 15:38:11.178][request][INFO] POST /identity/connect/token
[2021-04-14 15:38:11.269][error][ERROR] 2FA token not provided
[2021-04-14 15:38:11.269][response][INFO] POST /identity/connect/token (login) => 400 Bad Request
[2021-04-14 15:38:11.330][request][INFO] POST /api/two-factor/send-email-login
[2021-04-14 15:38:11.692][response][INFO] POST /api/two-factor/send-email-login (send_email_login) => 200 OK

Originally created by @H4R0 on GitHub (Apr 14, 2021). ### Subject of the issue Chrome Bitwarden extension is not asking for 2fa method on login anymore. This started 2 days ago after I upgraded to bitwardenrs/server:latest The Desktop Client as well as the Web Vault is asking for 2fa method. How can 2fa even be bypassed ?! The Extension is LOGGED OUT not LOCKED ! * bitwarden_rs version: https://hub.docker.com/layers/bitwardenrs/server/latest/images/sha256-20dfe5e0abf10febf01510a8a97a639372b933bfcb215b6a3a46fc09246b5f77 * Install method: Docker * Clients used: https://chrome.google.com/webstore/detail/nngceckbapebfimnlniiiahkandclblb ### Steps to reproduce Setup 2fa with email or anything else and login using the chrome extension. ### Expected behaviour Client should ask for 2fa ### Actual behaviour Client logs in without asking for 2fa ### Troubleshooting data The container log differs for both logins. Chrome Extension not asking for 2fa: > [2021-04-14 15:37:44.171][request][INFO] POST /api/accounts/prelogin [2021-04-14 15:37:44.183][response][INFO] POST /api/accounts/prelogin (prelogin) => 200 OK [2021-04-14 15:37:44.252][request][INFO] POST /identity/connect/token [2021-04-14 15:37:44.378][bitwarden_rs::api::identity][INFO] User user@example.org logged in successfully. IP: 192.168.1.xxx [2021-04-14 15:37:44.379][response][INFO] POST /identity/connect/token (login) => 200 OK [2021-04-14 15:37:44.435][request][INFO] GET /api/sync [2021-04-14 15:37:44.484][response][INFO] GET /api/sync?<data..> (sync) => 200 OK [2021-04-14 15:37:44.492][parity_ws::io][INFO] Accepted a new tcp connection from 192.168.1.xxx:56006. Desktop Client asking for 2fa: > [2021-04-14 15:38:11.099][request][INFO] POST /api/accounts/prelogin [2021-04-14 15:38:11.101][response][INFO] POST /api/accounts/prelogin (prelogin) => 200 OK [2021-04-14 15:38:11.178][request][INFO] POST /identity/connect/token [2021-04-14 15:38:11.269][error][ERROR] 2FA token not provided [2021-04-14 15:38:11.269][response][INFO] POST /identity/connect/token (login) => 400 Bad Request [2021-04-14 15:38:11.330][request][INFO] POST /api/two-factor/send-email-login [2021-04-14 15:38:11.692][response][INFO] POST /api/two-factor/send-email-login (send_email_login) => 200 OK
OVERLORD commented 2026-02-04 23:37:16 +03:00
Author
Owner
Copy Link

@jjlin commented on GitHub (Apr 14, 2021):

You probably enabled Remember me; see https://bitwarden.com/help/article/twostep-faqs/#q-why-is-bitwarden-not-asking-for-my-enabled-two-step-login-method.

@jjlin commented on GitHub (Apr 14, 2021): You probably enabled `Remember me`; see https://bitwarden.com/help/article/twostep-faqs/#q-why-is-bitwarden-not-asking-for-my-enabled-two-step-login-method.
OVERLORD commented 2026-02-04 23:37:23 +03:00
Author
Owner
Copy Link

@H4R0 commented on GitHub (Apr 14, 2021):

Thanks a lot, must have clicked it by accident.

Settings → My Account -> Deauthorize Sessions

@H4R0 commented on GitHub (Apr 14, 2021): Thanks a lot, must have clicked it by accident. Settings → My Account -> Deauthorize Sessions
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
SSO
Third party
better for forum
bug
bug
documentation
duplicate
enhancement
future Vault
future Vault
future Vault
good first issue
help wanted
low priority
notes
pull-request
Mirrored from GitHub Pull Request
 question
troubleshooting
wontfix
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
OVERLORD
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/vaultwarden#1011
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?