Web vault on Firefox: mouse click on Log in / Continue does nothing (Enter key works)

[gittyhubbyfrankybobby]

Prerequisites

• I have searched the existing Closed AND Open Issues AND Discussions
• I have searched and read the documentation

Vaultwarden Support String

Can provide on request. Summary: Vaultwarden 1.37.5, web vault 2026.10.1, official Docker image, DOMAIN set to an https URL, behind nginx.

Vaultwarden Build Version

1.37.5 (web vault 2026.10.1). Also seen on 1.36.0 before the upgrade.

Deployment method

Official Container Image

Custom deployment method

No response

Reverse Proxy

nginx 1.31.4

Host/Server Operating System

Linux

Operating System Version

Client: Windows 11 Pro (26300)

Clients

Web Vault

Client Version

Firefox 159.0 (release channel). Edge on the same machine works.

Steps To Reproduce

1. Open the web vault in Firefox 159 on Windows. A fresh profile with no add-ons also reproduces it.
2. Enter an email address and click Continue, or on the password page enter a password and click Log in, using the mouse.
3. Watch the server log and the browser console / network tab.

Expected Result

Clicking the button submits the form: the web vault derives the key and sends POST /identity/connect/token.

Actual Result

The button shows its hover/pressed state, but nothing else happens. No request is sent and nothing is logged in the console. The server log shows POST /identity/accounts/prelogin/password and then nothing more.

Any of these submit normally in the same session:

• pressing Enter in the password (or email) field: the console logs [LegacyCompatKeyService] Deriving master key took 137ms, then POST /identity/connect/token is sent and returns the expected 400 for a wrong password;
• calling .click() on the button from the devtools console.

So the form logic, KDF (PBKDF2 600000), WebCrypto and WASM all work in Firefox. Only a real mouse click on the submit button is lost. The same happens in Firefox with or without add-ons, and in private windows. Edge (Chromium) on the same machine logs in with a mouse click without problems.

Logs

[request][INFO] GET /api/devices/knowndevice
[request][INFO] POST /identity/accounts/prelogin/password
[response][INFO] (prelogin_password) POST /identity/accounts/prelogin/password => 200 OK
<- mouse click on "Log in": nothing further is received
<- pressing Enter instead:
[request][INFO] POST /identity/connect/token

Screenshots or Videos

No response

Additional Context

The only console errors are two CSP default-src 'none' messages for theme_head.*.js and styles.*.js, raised from NetUtil.sys.mjs. They look like devtools source fetches and do not appear related.

This may be an upstream Bitwarden web client issue in how it handles the submit-button click under Gecko. I have not tested against an official Bitwarden server. Workaround: press Enter instead of clicking.

[BlackDex]

First of all, we do ask for the support string for a reason, not just for the fun of it.
Looking at the last line of your report, is says default-src 'none' for the CSP, which mean you have altered the CSP.
This is not supported by Vaultwarden, and probably the cause of your issues.

Ensure that all checks are green and no errors appear, then check again.