[PM-41914] [PM-40883 Related] WebAuthn 2FA: Timeout and Cloudflare 522 Error when Firefox is the default browser

[eonardol]

Steps To Reproduce

1. Set Firefox for Android as the system's default browser.
2. Open the Bitwarden Android app and attempt to log in using an account protected by WebAuthn/FIDO2 2FA (EU Cloud).
3. Select YubiKey (via USB-C or NFC) for 2FA.
4. When the WebAuthn prompt opens via Custom Tabs, enter the YubiKey PIN / complete User Verification.

Expected Result

The WebAuthn authentication completes successfully, the Custom Tab closes, and the user is logged into the Bitwarden app.

Actual Result

After completing the YubiKey PIN/User Verification prompt, the request hangs, times out, and displays a Cloudflare Error 522 page instead of redirecting back to the app.

Screenshots or Videos

No response

Additional Context

• Workaround: Changing the default browser from Firefox to Google Chrome immediately resolves the issue, allowing the WebAuthn flow to complete without any errors.
• Related Issue: This seems closely related to (or a variation of) [PM-40883] WebAuthn 2FA: callback cannot return to the app when Firefox is the default browser — Custom Tab lands on the bitwarden.com 404 page #7205 (PM-40883), though in this case, it results in a Cloudflare 522 timeout during the YubiKey PIN/UV step rather than a 404 page.
• Mozilla Bug: I have also submitted a bug report to Mozilla (Bug ID: 2063051) to cover both sides of the integration issue.

Build Version

2026.7.0 (21756)

What server are you connecting to?

EU

Self-host Server Version

No response

Environment Details

• Device: Google Pixel 7
• OS: Android 17
• Default Browser: Firefox for Android (Fails with 522) vs Google Chrome (Works)
• 2FA Method: YubiKey (USB-C / NFC) with PIN/User Verification

Issue Tracking Info

• I understand that work is tracked outside of Github. A PR will be linked to this issue should one be opened to address it, but Bitwarden doesn't use fields like "assigned", "milestone", or "project" to track progress.

[bitwarden-bot]

Thank you for your report! We've added this to our internal board for review.
ID: PM-41914

[pamperer562580892423]

Another user here.

1. Could you add (copy & paste) all details from the BW app > Settings > About > Version (per comment or add it to your report above)? [PS: BW Android app 2026.7.1 should be available now]

2. I'm not sure if the Flight Recorder might catch some additional and helpful data?!

[eonardol]

@pamperer562580892423 here are the version details copied from Settings > About > Version:

© Bitwarden Inc. 2015-2026

Version: 2026.7.1 (21803)
📱 google Pixel 7 🤖 17@37 📦 prod
🧱 commit: abb9dde
💻 build source: bitwarden/android/actions/runs/30475765167/attempts/1
🦀 SDK: 3.0.0-7926-a9b0e184
🌩 Server: 2026.7.2 @ EU

[Adedamola-Aina]

Hello @eonardol

Thank you for the detailed report and reproduction steps.

The behavior you described has been flagged to our engineering team for further investigation and is now being tracked internally.

If you have any additional information, screenshots, recordings, or test results that may help with the investigation, please feel free to add them here.

Thanks again!

[devurandom]

I have the same issue:

© Bitwarden Inc. 2015-2026

Version: 2026.7.1 (21803)
📱 Fairphone FP3 🤖 13@33 📦 prod -fdroid
🧱 commit: abb9dde
💻 build source: bitwarden/android/actions/runs/30475765167/attempts/1
🦀 SDK: 3.0.0-7926-a9b0e184
🌩 Server: 2026.8.0 @ EU

I also tried https://bitwarden.com/help/setup-two-step-login-fido/#nfc-troubleshooting, but to no effect. Plugging in the key via USB-C does not appear to do anything, either.