Steps To Reproduce
- On a Sony Xperia 1 VII, enable Unlock with biometrics in Bitwarden.
- Allow the vault to lock, or request autofill while the vault is locked.
- Start the fingerprint authentication prompt.
- Place a registered finger on the phone's side-mounted fingerprint sensor.
- Repeat the authentication process until the fingerprint sensor responds unusually slowly. When this happens, recognition and vibration take approximately one second.
- The finger can sometimes be removed from the sensor before the delayed success indication appears.
- Android's native biometric UI reports successful authentication, but Bitwarden subsequently reports that biometric unlock failed.
Expected Result
When Android's biometric prompt reports successful fingerprint authentication, the authenticated Keystore cipher should be authorized and Bitwarden should unlock the vault.
If Android fails to authorize the cryptographic operation despite reporting biometric success, Bitwarden should treat that attempt as transient, preserve the existing biometric configuration, and allow the user to retry.
Actual Result
Android's native biometric UI reports successful fingerprint authentication, including the success indication and vibration.
Immediately afterward, Bitwarden reports that biometric unlock failed and says that biometric authentication must be enabled again. The “Unlock with biometrics” setting is then disabled.
The Flight Recorder shows that Bitwarden's cipher operation failed because Android Keystore had not received an authentication token, despite the native biometric success:
javax.crypto.IllegalBlockSizeException
Caused by: android.security.KeyStoreException: Key user not authenticated
No operation auth token received.
Error::Km(KEY_USER_NOT_AUTHENTICATED)
public error code: 2
Screenshots or Videos
No response
Additional Context
This problem is intermittent. Biometric unlock normally works, but it is more likely to fail when the fingerprint sensor takes approximately one second to respond. In the failure case, I can sometimes remove my finger before the sensor eventually vibrates and Android displays the successful authentication state.
The same stored biometric key successfully unlocked the vault numerous times earlier in the same Flight Recorder session. This means that the saved key and ciphertext were not permanently corrupt.
Immediately after the native biometric success, the Flight Recorder captured:
unlockVaultWithBiometrics failed when decrypting biometrics key
javax.crypto.IllegalBlockSizeException
at android.security.keystore2.AndroidKeyStoreCipherSpiBase.engineDoFinal(...)
at javax.crypto.Cipher.doFinal(...)
Caused by: android.security.KeyStoreException:
Key user not authenticated
internal Keystore code: -26
Caused by:
Trying to get auth tokens for uid 10363
In AuthInfo::get_auth_tokens.
No operation auth token received.
Error::Km(KEY_USER_NOT_AUTHENTICATED)
public error code: 2
internal Keystore code: -26
This appears to indicate that the Xperia/Android biometric stack reported a successful fingerprint match but did not attach the corresponding authentication token to Bitwarden's pending Keystore operation.
Bitwarden correctly refuses to decrypt the vault key without Keystore authorization. However, it currently catches the resulting GeneralSecurityException as a BiometricDecodingError and immediately clears the user's biometric configuration. In this case, the underlying Keystore error is ERROR_USER_AUTHENTICATION_REQUIRED, rather than evidence of a permanently corrupt or invalidated key.
A safer recovery behaviour may be to inspect the exception cause chain. If it contains an android.security.KeyStoreException with numeric error code ERROR_USER_AUTHENTICATION_REQUIRED, Bitwarden could preserve the biometric key and configuration, then allow or request another biometric attempt using a fresh cipher. Permanent key-invalidity and genuine decoding errors could continue to clear the configuration.
Possibly related existing issue: #6550
I can provide the complete Flight Recorder to the Bitwarden team through a non-public channel if additional diagnostics are required.
Build Version
2026.8.0 (21819)
What server are you connecting to?
US
Self-host Server Version
No response
Environment Details
- Device: Sony Xperia 1 VII (XQ-FS44)
- OS Version: Android 16 (API 36)
- Device firmware/build: 71.1.A.2.210
- Bitwarden build: release/standard
- Bitwarden CI commit: 8be53c1
- Bitwarden SDK: 3.0.0-8157-eb825d59
- Server: Bitwarden Cloud, US region
- Server version recorded by Flight Recorder: 2026.8.0
- Reproduction frequency: Intermittent
- Biometric hardware: Side-mounted fingerprint sensor
Issue Tracking Info
Steps To Reproduce
Expected Result
When Android's biometric prompt reports successful fingerprint authentication, the authenticated Keystore cipher should be authorized and Bitwarden should unlock the vault.
If Android fails to authorize the cryptographic operation despite reporting biometric success, Bitwarden should treat that attempt as transient, preserve the existing biometric configuration, and allow the user to retry.
Actual Result
Android's native biometric UI reports successful fingerprint authentication, including the success indication and vibration.
Immediately afterward, Bitwarden reports that biometric unlock failed and says that biometric authentication must be enabled again. The “Unlock with biometrics” setting is then disabled.
The Flight Recorder shows that Bitwarden's cipher operation failed because Android Keystore had not received an authentication token, despite the native biometric success:
javax.crypto.IllegalBlockSizeException
Caused by: android.security.KeyStoreException: Key user not authenticated
No operation auth token received.
Error::Km(KEY_USER_NOT_AUTHENTICATED)
public error code: 2
Screenshots or Videos
No response
Additional Context
This problem is intermittent. Biometric unlock normally works, but it is more likely to fail when the fingerprint sensor takes approximately one second to respond. In the failure case, I can sometimes remove my finger before the sensor eventually vibrates and Android displays the successful authentication state.
The same stored biometric key successfully unlocked the vault numerous times earlier in the same Flight Recorder session. This means that the saved key and ciphertext were not permanently corrupt.
Immediately after the native biometric success, the Flight Recorder captured:
This appears to indicate that the Xperia/Android biometric stack reported a successful fingerprint match but did not attach the corresponding authentication token to Bitwarden's pending Keystore operation.
Bitwarden correctly refuses to decrypt the vault key without Keystore authorization. However, it currently catches the resulting
GeneralSecurityExceptionas aBiometricDecodingErrorand immediately clears the user's biometric configuration. In this case, the underlying Keystore error isERROR_USER_AUTHENTICATION_REQUIRED, rather than evidence of a permanently corrupt or invalidated key.A safer recovery behaviour may be to inspect the exception cause chain. If it contains an
android.security.KeyStoreExceptionwith numeric error codeERROR_USER_AUTHENTICATION_REQUIRED, Bitwarden could preserve the biometric key and configuration, then allow or request another biometric attempt using a fresh cipher. Permanent key-invalidity and genuine decoding errors could continue to clear the configuration.Possibly related existing issue: #6550
I can provide the complete Flight Recorder to the Bitwarden team through a non-public channel if additional diagnostics are required.
Build Version
2026.8.0 (21819)
What server are you connecting to?
US
Self-host Server Version
No response
Environment Details
Issue Tracking Info