#7568 Email 2FA fails on iOS app ("No password hash has been submitted") while working fine in browser

Prerequisites

I have searched the existing Closed AND Open Issues AND Discussions
I have searched and read the documentation

Vaultwarden Build Version

1.37.1 (docker tag: 1.37.1-alpine)

Deployment method

Official Container Image (Docker/Kubernetes)

Clients

iOS app (Bitwarden) — app version: 2026.7.1

Steps To Reproduce

Have email 2FA enabled on the account.
Log in to the web vault (browser) with the same account/2FA. -> Email 2FA works correctly, code is received and login succeeds.
Log in to the Bitwarden iOS app with the same account. -> App attempts to send/trigger the email 2FA code and fails.

Expected Result

Email 2FA code is sent and login completes, same as in the browser.

Actual Result

Login fails. Server logs show the token endpoint rejecting the login for missing 2FA, followed by the app's request to resend the email code being rejected server-side.

Logs

[2026-08-09 08:36:59.743+0000][error][ERROR] 2FA token not provided
[2026-08-09 08:36:59.743+0000][response][INFO] (login) POST /identity/connect/token => 400 Bad Request
[2026-08-09 08:36:59.818+0000][request][INFO] POST /api/two-factor/send-email-login
[2026-08-09 08:36:59.820+0000][vaultwarden::api::core::two_factor::email][ERROR] No password hash has been submitted.

Additional Context

Looking at the current send_email_login handler (src/api/core/two_factor/email.rs), this error is only reached when the request includes an email but neither a masterPasswordHash nor an authRequestId/authRequestAccessCode. Since this only reproduces via the iOS app (browser login works fine), it looks like the iOS client's request to /api/two-factor/send-email-login in this login path isn't populating either of those fields. Not yet isolated whether this is specific to a re-auth/quick-unlock path or also happens on a fresh password login from the app.