[PR #6190] [MERGED] Fix Webauthn/Passkey 2FA migration/validation issues #2445

New Issue

OVERLORD · 2025-10-09T18:05:17+03:00

OVERLORD commented

2025-10-09 18:05:17 +03:00

📋 Pull Request Information

Original PR: https://github.com/dani-garcia/vaultwarden/pull/6190
Author: @BlackDex
Created: 8/16/2025
Status: ✅ Merged
Merged: 8/25/2025
Merged by: @dani-garcia

Base: main ← Head: webauthn-fixes

📝 Commits (3)

c9070cf Apply Passkey fixes from zUnixorn
d2632a3 Fix Webauthn/Passkey 2FA migration issues
5d0ade4 Fix comments

📊 Changes

2 files changed (+114 additions, -17 deletions)

View changed files

📝 Cargo.toml (+1 -2)
📝 src/api/core/two_factor/webauthn.rs (+113 -15)

📄 Description

Applied SecurityKey to Passkey fixes from @zUnixorn

Fix Webauthn/Passkey 2FA migration issues

Because the webauthn-rs v0.3 crate did not know or store new flags currently used in v0.5, some verifications failed.
This mainly failed because of a check if a key was backuped or not, and if it was allowed to do so.

Most hardware keys like YubiKey's do not have this flag enabled and can't be duplicated or faked via software.

Since the rise of Passkey's, like Bitwarden's own implementation, and other platforms like Android, and Apple use Software keys which are shared between devices, they set these backup flags to true. This broke the login attempts, because the default during the migration was false, and cause an error during validation.

This PR checks for the flags during the response/verification step, and if these flags are true, then search for the stored key, adjust it's value, and also update the current challenge state to match, to prevent the first login attempt to fail.

This should not cause any issue, since the credential-id is checked and matched, and only updated when needed.

Fixes #6154

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/dani-garcia/vaultwarden/pull/6190 **Author:** [@BlackDex](https://github.com/BlackDex) **Created:** 8/16/2025 **Status:** ✅ Merged **Merged:** 8/25/2025 **Merged by:** [@dani-garcia](https://github.com/dani-garcia) **Base:** `main` ← **Head:** `webauthn-fixes` --- ### 📝 Commits (3) - [`c9070cf`](https://github.com/dani-garcia/vaultwarden/commit/c9070cf4626d5bcf39c8874b7e92f9e3ff2dbdb7) Apply Passkey fixes from zUnixorn - [`d2632a3`](https://github.com/dani-garcia/vaultwarden/commit/d2632a3399554702c67b97e26e1774e9c166f75a) Fix Webauthn/Passkey 2FA migration issues - [`5d0ade4`](https://github.com/dani-garcia/vaultwarden/commit/5d0ade4db5b905d762cdff8292b0db80aa9f9664) Fix comments ### 📊 Changes **2 files changed** (+114 additions, -17 deletions) <details> <summary>View changed files</summary> 📝 `Cargo.toml` (+1 -2) 📝 `src/api/core/two_factor/webauthn.rs` (+113 -15) </details> ### 📄 Description - Applied SecurityKey to Passkey fixes from @zUnixorn ### Fix Webauthn/Passkey 2FA migration issues Because the webauthn-rs v0.3 crate did not know or store new flags currently used in v0.5, some verifications failed. This mainly failed because of a check if a key was backuped or not, and if it was allowed to do so. Most hardware keys like YubiKey's do not have this flag enabled and can't be duplicated or faked via software. Since the rise of Passkey's, like Bitwarden's own implementation, and other platforms like Android, and Apple use Software keys which are shared between devices, they set these backup flags to true. This broke the login attempts, because the default during the migration was `false`, and cause an error during validation. This PR checks for the flags during the response/verification step, and if these flags are `true`, then search for the stored key, adjust it's value, and also update the current challenge state to match, to prevent the first login attempt to fail. This should not cause any issue, since the credential-id is checked and matched, and only updated when needed. Fixes #6154 --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

OVERLORD added the pull-request label 2025-10-09 18:05:17 +03:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/vaultwarden#2445