Hang at Webauthn "Verify your Identity" spinner trying to use Nitrokey 3C NFC

[mippersiel]

Steps To Reproduce

1. Go to self-hosted Bitwarden URL
2. Enter email address
3. Enter master password
4. Get redirected at https://{my_host}/#/2fa

Expected Result

At https://{my_host}/#/2fa, get prompted to touch my Nitrokey 3C NFC for Webauthn and then complete my login

Actual Result

Page hangs at https://{my_host}/#/2fa and there's a spinner animation.

Screenshots or Videos

Hanging screen:

Additional Context

• With the same browser I have issues logging in with, I was able to provision my Nitrokey for 2FA through the web interface.
• When logging in with the Firefox extension (same browser again), the 2FA prompt redirects me to https://{my_host}/webauthn-fallback-connector.html and that URL works; My extension logs in successfully.

• I have no issues logging in with my iPhone's Bitwarden app either. I use my email + master password and the NFC feature of my Nitrokey and I'm logged in.
• I have tried with Brave and Chromium browsers, same hanging at https://{my_host}/#/2fa

Operating System

Linux

Operating System Version

Arch Linux

Web Browser

Firefox

Browser Version

Floorp 12.7.0@145.0.1 (64-bit)

Build Version

2025.11.1+28469e0

Issue Tracking Info

• I understand that work is tracked outside of Github. A PR will be linked to this issue should one be opened to address it, but Bitwarden doesn't use fields like "assigned", "milestone", or "project" to track progress.

[bitwarden-bot]

Thank you for reporting this issue! We've added this to our internal tracking system.
ID: PM-28970
Link (for internal use): https://bitwarden.atlassian.net/browse/PM-28970

[pamperer562580892423]

What is your server version?

[mippersiel]

What is your server version?

2025.11.1+28469e0

I should have checked the developer tools in my browser (Firefox) to give you more info. Here's what I found that might be of interest:

I'm no web developer so this might have some other security considerations, but it could be a simple test to change the X-Frame-Options header to SAMEORIGIN instead of DENY

[pamperer562580892423]

Ah, that's probably helpful! (BTW, I'm just another user)

What is your server version?

2025.11.1+28469e0

Maybe I looked at the wrong place yesterday, but isn't that only the Web Vault version (that you wrote in "Build version" already) and not the server version?

[mippersiel]

Well, when writing the issues, I read that the version should be taken at the bottom of the BW page. I did try to see if I could get more info with the bitwarden.sh script, but I found nothing. I saw a guy requesting to add another option like version to the script, but it's not implemented (at least, yet).

[pamperer562580892423]

I think you can always find your server (and web vault) versions in the Admin Dashboard.

[mippersiel]

Pulled from the admin page:

Server Installed  2025.11.0
Server Latest     2025.11.0
Web Installed     2025.11.1+28469e0
Web Latest        2025.11.1

[rmcdowell-bitwarden]

Hi there,

I am unable to reproduce this issue, it has been escalated for further investigation. If you have more information that can help us, please add it below.

Thanks!

[mippersiel]

Hi there,

I am unable to reproduce this issue, it has been escalated for further investigation. If you have more information that can help us, please add it below.

Thanks!

Hi!
Thanks for the follow-up! The only other detail that I could mention is that my instance is behind two proxies:

Web facing (HTTPs)
↓ (proxy 1)
Remote location (HTTPs)
↓ (proxy 2)
Bitwarden instance (HTTP on private network)

Although not sure if this is relevant to the issue since 2FA does work in some circumstances.

[tanpro260196]

I'm having similar issue but only on Windows client, Web UI and Browser extension works fine.
Roll back to 2025.10 client doesn't fix this issue so I'm thinking maybe something is wrong with how Windows 11 handle WebAuth.

[pamperer562580892423]

@tanpro260196 Out of curiosity, I logged out, closed, and logged back in to my desktop app on Windows 11. I had no issue with using my YubiKey 5 as 2FA-passkey.

so I'm thinking maybe something is wrong with how Windows 11 handle WebAuth.

Well, maybe you could check if your Win 11 system is up-to-date. I'm on 25H2 with the latest updates installed (Build 26200.7309)