This submission has been redacted by the customer

Disclosed by
FluffyWaffle
  • Engagement 1Password
  • Disclosed date almost 3 years ago
  • Reward $900
  • Priority P3 Bugcrowd's VRT priority rating
  • Status Resolved This vulnerability has been accepted and fixed
Summary by 1Password

The issue was a user could use a newly enrolled fingerprint on Android to unlock 1Password without needing to enter the Master Password first. This was resolved in Android 8.10.0 as shown in our release notes here: https://releases.1password.com/android/8.10/#1password-for-android-8.10.0

Summary by FluffyWaffle

Original problem: The Android app fails to detect when a new fingerprint is added to a phone and thus can be unlocked by knowing only the device PIN/password.

This has since been resolved in Android app version 8.10.0. When a new fingerprint is added it will reprompt for the 1Password master password before biometric unlocking is enabled again.

Activity