• Operating System: Windows 11 Enterprise 24H2 (OS build 26100.7840)

• Browser: Firefox 143.0.1 (64‑bit)

• Enpass Desktop: 6.11.20 (2229)

• Enpass Firefox Extension: 6.11.12.1

Steps to reproduce

1. Lock the Enpass vault (e.g., via auto‑lock or manual lock).

2. Open a website in Firefox that has a login form.

3. Click the Enpass browser icon or try to trigger autofill on the username/password field.

Expected behavior

• The Enpass extension should either:

  • Show a visible login popup prompting me to unlock the vault, or

  • Not open any overlay until the vault is unlocked in the main Enpass app.

Actual behavior

• A popup window appears but is fully transparent / invisible, yet it still occupies the screen area where the unlock/login window should be.

• Mouse interaction in that region is blocked: clicks do not reach the underlying page or form fields.

• The issue persists until I:

  • Open the main Enpass desktop application,

  • Unlock the vault there,

  • Return to Firefox, at which point the extension behaves normally again.

Additional notes

• The ghost/invisible popup does not react to clicks and cannot be closed via the browser UI.

• The issue reproduces consistently on Windows 11 Enterprise 24H2 with Firefox 143.0.1, as long as the vault is locked when the extension is triggered.

Please let me know if you need logs, screenshots, or a screen recording to further diagnose this behavior.

any idea what to do?

Issue: Passkey registration immediately fails with NotAllowedError on sites that set authenticatorSelection.userVerification to "discouraged" in their WebAuthn navigator.credentials.create() call. The Enpass passkey prompt never

appears.

Affected site: npmjs.com (2FA setup)

Steps to reproduce:

1. Go to npmjs.com → Account Settings → Enable 2FA

2. Enpass prompt never appears, site shows "Device registration failed"

3. Browser console shows: NotAllowedError: The request is not allowed by the user agent or the platform in the current context

Root cause: npmjs.com passes userVerification: "discouraged" and residentKey: "discouraged" in the WebAuthn options. This is a valid WebAuthn configuration, but Enpass immediately rejects it.

Proof: Patching the options to "preferred" before the call reaches Enpass makes it work:

const origCreate = navigator.credentials.create.bind(navigator.credentials);

navigator.credentials.create = function(opts) {

opts.publicKey.authenticatorSelection.userVerification = "preferred";

opts.publicKey.authenticatorSelection.residentKey = "preferred";

return origCreate(opts);

};

After this patch, Enpass opens normally and registration succeeds.

Comparison: Sites like webauthn.io that use userVerification: "preferred" work fine with Enpass.

Confirmed not Firefox: A clean Firefox profile with no extensions shows Firefox's native WebAuthn dialog on npmjs.com without issues.