Bug Report: 1Password + Duo Universal Prompt authentication fails with BadRequest in latest RDM

Hello Devolutions Support Team,

We are reporting a critical bug in the latest version of Remote Desktop Manager (RDM) affecting 1Password integration when Duo Universal Prompt is enabled.

---

ENVIRONMENT
- Product: Remote Desktop Manager (latest version)
- Feature: 1Password password manager integration
- MFA: Duo Security (Universal Prompt enabled, Traditional Prompt deprecated)
- OS: Windows

---

PROBLEM SUMMARY

When attempting to authenticate to 1Password through RDM using Duo MFA with the Universal Prompt, the authentication fails. This worked correctly approximately 4 months ago. We have not changed our Duo configuration — we migrated to Duo Universal Prompt over a year ago and it works correctly with the native 1Password Windows application.

---

ROOT CAUSE (identified through reverse engineering)

We have performed reverse engineering of the PasswordManagerAccess.dll (version 33.4.1.0) included in RDM and identified the following two issues:

1. PRIMARY CRASH — DuoV4.SubmitSystemProperties
The method searches for an HTML form with id='plugin_form', which only exists in the old Duo Traditional Prompt. The Duo Universal Prompt returns a React-based page with no such form, causing an immediate exception:

InternalErrorException: Duo HTML: the main form is not found
at PasswordManagerAccess.Duo.DuoV4.SubmitSystemProperties(...)
at PasswordManagerAccess.Duo.DuoV4.AuthenticateAsync(...)
at PasswordManagerAccess.OnePassword.Client.AuthenticateWithDuo(...)

2. SECONDARY ISSUE — OAuth flow not handled
The Duo Universal Prompt uses an OAuth 2.0 flow with the following authorize URL:
https://api-XXXXXXXX.duosecurity.com/oauth/v1/authorize?client_id=...&response_type=code

The current code in AuthenticateAsync only handles two redirect cases:
- /frame/frameless/v3/auth → redirects to V1
- (default) → calls SubmitSystemProperties → CRASHES

There is no handler for the /oauth/v1/ flow, which is what Duo Universal Prompt uses exclusively.

---

FULL STACK TRACE

PasswordManagerAccess.Common.InternalErrorException: Duo: Duo HTML: the main form is not found
at PasswordManagerAccess.Duo.DuoV4.SubmitSystemProperties(HtmlDocument html, String url, Dictionary`2 cookies, RestClient rest, CancellationToken cancellationToken)
at PasswordManagerAccess.Duo.DuoV4.AuthenticateAsync(String authUrl, MfaMethod[] otherMethods, IDuoAsyncUi ui, IRestTransport transport, ISimpleLogger logger, CancellationToken cancellationToken)
at PasswordManagerAccess.OnePassword.Client.AuthenticateWithDuo(SecondFactor factor, MfaMethod[] otherFactors, IAsyncUi ui, RestClient rest, CancellationToken cancellationToken)
at PasswordManagerAccess.OnePassword.Client.GetSecondFactorResult(...)

---

REFERENCE FIX

The open-source library 'password-manager-access' by detunized (which your DLL appears to be based on) released a fix for this exact issue in version 22.0.4:

CHANGELOG entry:
"22.0.4 — 1Password: fixed an issue with Duo MFA failing to authenticate in some situations"
Also backported in versions 22.1.2 and 26.1.1.

Your internal DLL is version 33.4.1.0 and does not appear to include this fix.



REQUEST

Please integrate the Duo Universal Prompt OAuth flow fix into the PasswordManagerAccess.dll included in RDM as soon as possible. This is a blocking issue for any organization using 1Password + Duo Universal Prompt.

Thank you for your support.

Best regards