Switched Account, Bypassed 2fa Security?!?!

  1. This morning, I tried to log in to the BW app (on my iMac).

  2. I got this screen:

  1. I chose Switch Account at the top right, selected the same account I was trying to log in to.

4. I was in. My vault opened!

When I logged out and logged in again, the Switch Account option was not available.

I highly doubt that anything was bypassed, but if you are able to reproduce the behavior that you described above, then we could try to troubleshoot and get to the bottom of what happened.

The only ways to truly bypass the 2FA requirement for logging in are to click the “Remember me” option or to supply the 2FA Recovery Code.

The fact that your account was available in the “Switch Account” menu proves that the account in question was already logged in. This is why you did not need 2FA, which is a requirement only for logging in to an account that is logged out, and is not required to unlock an account that is already logged in.

I agree, and I wasn’t even going to post this because I couldn’t be sure what happened. Note that I was surprised to see 2fa being triggered, because it hadn’t been 30 days since I’d selected Remember me.

However, I had taken that screenshot, and it shows that it was telling me I couldn’t log in, but it was simultaneously showing the Switch Account option.

Is there anything that could explain those two things appearing at the same time? That is, if I was logged in, why did it request 2fa?

Well, one explanation would be that you have a second Bitwarden account (or somebody else using the iMac has a Bitwarden account), and you were attempting to log in to that account.

Hmm.

I recently set up a BW account for my wife (on her Macbook), but I’m sure I never signed into her account on my iMac, and I expect I’d have noticed her email instead of mine.

Thanks for the help.

Occasionally, there are “glitches”. Usually solved by restarting an app, and/or rebooting, and sometimes by reinstallation of the app.

Unless this is something that happens frequently, I wouldn’t worry about it.

Together with some help from BW, I think I’ve figured out what happened. If I choose Add Account, and log into my wife’s account, then, when it gets to the 2fa part I choose Switch Account and go back to mine, I get the behavior I saw.

OK, so it sounds pretty much like what I had suggested above.