[PM-39442] Blank Screen on SSO Login

[lucasdina]

Steps To Reproduce

Open Bitwarden Android app
Select Log in with SSO / OIDC
Enter self-hosted Vaultwarden server URL
Redirect to Authelia login page
Observe black screen where login UI should be rendered

Expected Result

Authelia login page should render normally inside the Bitwarden app WebView and allow authentication.

Actual Result

WebView becomes a black screen
No visible login UI renders
URL appears to load correctly
No obvious error shown in-app

Screenshots or Videos

No response

Additional Context

Sorry for the ai-slop but it was the easiest way to get everything together cleanly. I can produce vaultwarden, authelia, and nginxproxymanager configs and logs if requested but for my debugging, they weren't much help.

TL;DR SSO login shows a black screen. If the device is plugged into a desktop and debugger is used to mirror the screen on the desktop, the SSO page shows up correctly. The rest of the auth process works just fine.

Summary
When using the Bitwarden Android app with self-hosted Vaultwarden + Authelia OIDC, the authentication flow opens correctly but results in a black screen during the OIDC login page render. However, when the same WebView is inspected remotely using Chrome DevTools, the page immediately renders correctly and login can proceed normally. This strongly suggests an Android WebView rendering or lifecycle issue triggered during OIDC authentication.

Environment
Bitwarden Android app (latest at time of issue)
Android device (Vivaldi browser used for testing, Chromium-based WebView involved)
Vaultwarden 1.36.0
Authelia OIDC provider
Reverse proxy: OpenResty / Nginx Proxy Manager
OIDC flow: Authorization Code + PKCE
Steps to reproduce
Open Bitwarden Android app
Select Log in with SSO / OIDC
Enter self-hosted Vaultwarden server URL
Redirect to Authelia login page
Observe black screen where login UI should be rendered

Expected behavior
Authelia login page should render normally inside the Bitwarden app WebView and allow authentication.

Actual behavior

• WebView becomes a black screen
• No visible login UI renders
• URL appears to load correctly
• No obvious error shown in-app

Important observation (debugging breakthrough)
When using Chrome remote debugging:

• Connect Android WebView via chrome://inspect
  *Inspect the Bitwarden authentication WebView
• Once inspected:
• • The previously black screen renders correctly
• • Authelia login UI becomes visible
• • Login completes successfully
    This strongly suggests:
• A WebView rendering issue
• or a timing/lifecycle bug triggered by DevTools attachment

Additional notes
Authelia works correctly in:

• Desktop browsers
• Mobile Chrome/Vivaldi browser directly
• Vaultwarden OIDC flow completes successfully when WebView renders
• No CSP / X-Frame-Options errors observed in server logs
• Issue is not authentication failure, but UI rendering failure

Hypothesis
This may be caused by one of:

• Android System WebView regression
• Bitwarden app WebView configuration issue (hardware acceleration / composition layer)
• Timing issue in OIDC redirect handling
• Race condition in loading external identity provider page
• DevTools attachment forcing a different rendering pipeline (Skia/WebView compositor behavior change)

Workaround

• Attach Chrome DevTools to Android WebView (chrome://inspect)
• Trigger login flow
• Once inspected, UI renders normally (in debugging browser, not mobile, that is still blank) and login succeeds

Impact

• Prevents normal mobile login via OIDC for self-hosted setups
• Requires developer tooling to complete authentication
• Appears as a “black screen hang” to end users

Build Version

2026.5.1

What server are you connecting to?

Self-host

Self-host Server Version

Vaultwarden:1.36.0, Web-Vault:2026.4.1, Authelia:4.39.20

Environment Details

Vaultwarden:1.36.0, Web-Vault:2026.4.1, Authelia:4.39.20

Issue Tracking Info

• I understand that work is tracked outside of Github. A PR will be linked to this issue should one be opened to address it, but Bitwarden doesn't use fields like "assigned", "milestone", or "project" to track progress.

[bitwarden-bot]

Thank you for your report! We've added this to our internal board for review.
ID: PM-39442

[pamperer562580892423]

Another user here.

Self-host Server Version

Vaultwarden:1.36.0, Web-Vault:2026.4.1, Authelia:4.39.20

In your own interest: try to reproduce this with an official Bitwarden server (cloud or self-hosted)... ideally before this issue probably will be closed due to the unoffical server...

PS: Vaultwarden itself recommends this as well: https://github.com/dani-garcia/vaultwarden/wiki/Bitwarden-clients-troubleshooting

[rmcdowell-bitwarden]

Hi there,

It is important to note that Vaultwarden is not associated with Bitwarden. Vaultwarden is a re-writing of the Bitwarden server code in Rust, that is not contributed to nor supported by the Bitwarden team or organization. The security audits granted to Bitwarden do not apply to Vaultwarden, and the Bitwarden support team is not able to respond to questions regarding Vaultwarden. Support options for Vaultwarden are found here:

https://github.com/dani-garcia/vaultwarden?tab=readme-ov-file#get-in-touch

@pamperer562580892423 (thank you as always) is correct in that we ask that you please only report issues on Bitwarden's repositories when you are able to reproduce the behavior with an official Bitwarden server (cloud or self-hosted).

You can find information about using Bitwarden's self-hosted servers here: https://bitwarden.com/help/self-host-bitwarden/

This issue will now be closed.

Thanks!

[lucasdina]

@rmcdowell-bitwarden sorry about that, I can attempt again with the bitwarden backend. I wouldn't have opened this typically but the error is only an issue with authelia and the mobile app, and afaik, authelia is usable with the bitwarden backend. At the point I was seeing this issue, vaultwarden hadnt done anything but redirected to the authelia url. I figured since it wasn't an issue with the back end and only an issue with the mobile bitwarden and not the browser nor the plugin, it would be valid.