Skip to content

[PM-25632] Log in with device - entered email is case-sensitive for fingerprint phrase generation #5856

@Psionyde

Description

@Psionyde

Steps To Reproduce

  1. Have an existing BW client logged in
  2. Begin new device login from Android app
  3. Enter email address with arbitrary capitalisation (eg autocomplete capitalising first letter)
  4. Choose Log in with device
  5. Note fingerprint phrase mismatch between devices

Expected Result

Login attempt either fails to recognise account, or completes successfully with matching fingerprint.

Actual Result

Existing device receives an auth prompt with mismatched fingerprint phrase.

Screenshots or Videos

No response

Additional Context

The desktop apps convert email to lowercase before generating fingerprint in desktop auth-request.service.ts:224.
The Android app does not, see Android AuthRequestManagerImpl.kt:472 and Android AuthSdkSourceImpl.kt:45.
From what I can see in the iOS codebase it also seems to use the provided email without lowercasing it, see iOS AuthService.swift:832

Build Version

2025.8.1 (20670)

What server are you connecting to?

US

Self-host Server Version

No response

Environment Details

No response

Issue Tracking Info

  • I understand that work is tracked outside of Github. A PR will be linked to this issue should one be opened to address it, but Bitwarden doesn't use fields like "assigned", "milestone", or "project" to track progress.

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions