No master-password reprompt on 2025.11.0 when using physical security key?

pabs · November 17, 2025, 5:05pm

Hello,

I can’t set master-password reprompt on new items, nor is it asked for in items where the option was already set. This happens on both the browser extension and on the vault web page.

It seems to only happen when I log in via passkey with a physical security key. If I log in with master-password + 2FA both things work as expected (tested loggin in and out multiple times on web vault and extension). I think it started happening on my computer with the latest release, 2025.11.0.

Seems intended? I understand not needing the reprompt if using a physical security key, but the option to set the reprompt requiring master password or an available passkey should always be displayed, right? Is it plasuible that not doing a reprompt for important items could lead to security problems in situations of clickjacking and cookie hijacking?

I can’t find any posts or documentation about this, sorry if this has already been discussed!

BW and Browser Versions

Bitwarden extension version
Version: 2025.11.0
SDK: ‘main (8ef7951)’
Server version: 2025.11.0

Browser version
Version: 7.7.3851.48 (Official Build) (64-bit)
Chromium Version: 142.0.7444.167
Channel: Official Build
Platform / OS: Linux - ubuntu-core 22

grb · November 17, 2025, 6:42pm

There is a bug report on Github, although Bitwarden has not yet acknowledged the issue:

github.com/bitwarden/clients

Master password reprompt not honored or visible when not logged in using master password

opened 03:52PM - 13 Oct 25 UTC

bwbug

bug web

### Steps To Reproduce 1. Log in to any app using Master Password login, and cr…eate a vault item with "Master password re-prompt" enabled. 2. Log in to the Web Vault using Login with Passkey. 3. Click on the item that was created in **Step 1**. 4. Click on <kbd>Edit</kbd>. 5. Scroll to "Additional options" section. ### Expected Result * In **Step 3**, expect to be prompted to enter master password before the item is displayed. * In **Step 5**, expect to see an option for "Master password re-prompt", with a clickable checkbox to toggle the setting. ### Actual Result * In **Step 3**, item details are displayed immediately, with no prompt to enter master password before the item is displayed. * In **Step 5**, no option for enabling or disabling the "Master password re-prompt" option is seen ### Screenshots or Videos #### Item as seen in Desktop app with Master Password login (Edit view): <img width="724" height="332" alt="Image" src="https://github.com/user-attachments/assets/b29812b8-9019-4ef7-9182-c1e569561301" /> #### Item as seen in Web Vault with Passkey Login (Edit view): <img width="720" height="269" alt="Image" src="https://github.com/user-attachments/assets/318d674e-e543-4097-98f0-5520ff09c32d" /> ### Additional Context The "Master password re-prompt" option is also missing (and reprompt is not honored) when logging in using "Login with Device". The same issue occurs in the browser extension, Desktop app, and Web Vault. ### Operating System Windows ### Operating System Version Windows 11 ### Web Browser Chrome ### Browser Version _No response_ ### Build Version 2025.9.1 ### Issue Tracking Info - [x] I understand that work is tracked outside of Github. A PR will be linked to this issue should one be opened to address it, but Bitwarden doesn't use fields like "assigned", "milestone", or "project" to track progress.

pabs · November 17, 2025, 7:51pm

Aha, yes I see, same case as what I observed

Hopefully they will look into it then, thanks!