bitwarden / mobile

The mobile app vault (iOS and Android).
https://bitwarden.com
GNU General Public License v3.0
5.71k stars 756 forks source link

TOTP code can be viewed without entering the master password when 'Master password re-promt' is enabled #3206

Closed jonnykl closed 1 month ago

jonnykl commented 1 month ago

Steps To Reproduce

  1. Enable 'Master password re-promt' for an item
  2. Save the item
  3. Open the item

Expected Result

The TOTP code should not be visible until the master password has been re-entered.

Actual Result

The TOTP code is shown without the need to re-enter the master password. But if you want to copy the TOTP code, you have to re-enter the master password. This makes no sense as the TOTP code is already visible at this point.

Screenshots or Videos

No response

Additional Context

I noticed the same behavior in the Chrome extension.

Operating System

Android

Operating System Version

Android 14 (Xiaomi HyperOS 1.0.3.0.UMOEUXM)

Device

Xiaomi Redmi Note 12 Pro 5G

Build Version

2024.4.0 (10172)

Beta

micahblut commented 1 month ago

@jonnykl thanks for reporting. We have a similar report here that we are tracking. I will go ahead and close this report.