Username overwritten? (Moving from "No Folder" to a Folder?)

Ask the Community Password Manager
, ,
1

I’m using Bitwarden on a Microsoft Windows 11 device. I have the extension for Edge installed.

Since the change in the UI, I’m finding “simple tasks” such as deleting entries in the password manager, a few clicks more than it used to take, and I’d have to say the newer UI feels a bit backwards…

But anyway, this is not a gripe about the UI, but actually, potentially a bug?

Yesterday, I used the web vault to manage a few accounts that were in the default “No Folder” location, I moved them to their rightful home in my filing cabinet. In doing so, the username field within the entry had been overwritten with my Bitwarden account username.

Thankfully, I only moved ~10 login entries. But this could easily have been thousands. Now, I’m unsure if moving of the folder caused this, but there doesn’t appear to be any history against the username field… This could have been quite catastrophic.

To the point I’d like to understand if this is repeatable and/or what potentially caused this issue.

2

Something (either your browser or the Bitwarden browser extension) is configured to automatically autofill username/password fields, and has a saved username entry for your Web Vault login. For example, you may have enabled “Autofill on Page Load” in the Bitwarden browser extension, and created a login item that contains your Bitwarden username. Alternatively, your browser may have saved your Bitwarden username (associating it with the vault.bitwarden.com domain), and is automatically autofilling this information whenever it seems a username field presented in the Web Vault (whether you are logging in, or editing a vault item).

The solution is obvious — disable automatic autofilling, at least for the vault.bitwarden.com domain.

P.S. Did you check the password fields of the 10 items that were affected by this snafu?

3

Thanks, will check this tomorrow.

Thankfully, the passwords were not overwritten, but TOTP was added as well as the username overwritten.

4

Autofill is enabled, and my Bitwarden entry in my vault, was as you state, configured with the URL vault.bitwarden.com.

I’ve since turned off Autofill specifically for my Bitwarden credential and removed the URL “vault.bitwarden.com”.

This should suffice. I guess this is something to be aware of if using the web vault, it could have been quite catastrophic for me.

Perhaps some kind of history on the Username field would be a potential beneficial feature request…

5

Thanks for the update, glad you were able to resolve the issue.

Here is the relevant Feature Request thread: