Secure Notes with "Master Password Re-prompt" Can Be Viewed Without Re-authentication

[mi-alkhamis]

Steps To Reproduce

1. Open the Bitwarden app on an iOS device.
2. Create a new Secure Note.
3. Enable the "Master Password Re-prompt" option for this note.
4. Save the note.
5. Lock and then unlock the Bitwarden app using Face ID, Touch ID, or PIN.
6. Navigate to the Secure Note created in step 2.
7. Attempt to view or copy the contents of the note.

Expected Result

Upon attempting to view or copy the contents of a Secure Note with "Master Password Re-prompt" enabled, the app should prompt the user to enter their master password before granting access.

Actual Result

The app allows viewing and copying of the Secure Note's contents without prompting for the master password. The prompt only appears when attempting to edit the note.

Screenshots or Videos

No response

Additional Context

This issue poses a security risk, as sensitive information within Secure Notes can be accessed without proper authentication, contrary to the intended function of the "Master Password Re-prompt" feature.

Build Version

2025.2.0(1974)

What server are you connecting to?

US

Self-host Server Version

No response

Environment Details

• Device: Iphone 13
• OS Version: 18.3.1(22D72)

Issue Tracking Info

• I understand that work is tracked outside of Github. A PR will be linked to this issue should one be opened to address it, but Bitwarden doesn't use fields like "assigned", "milestone", or "project" to track progress.

[rmcdowell-bitwarden]

Hi there,

Thank you for your report!

I was able to reproduce this issue, and I have flagged this to our engineering team.

If you wish to add any further information/screenshots/recordings etc., please feel free to do so at any time - our engineering team will be happy to review these.

Thanks once again!