Artifact used: androidx.biometric:biometric:1.0.0

Devices/Android versions reproduced on:
Emulator 25 API, X86 (behaves the same on all versions)
Android version 7.1.1

Code:
https://github.com/Dimezis/BiometricBugs

Steps:
Have a stored fingerprint on the device.
Launch the example app, see the fingerprint dialog.
Rotate the screen.
See 2 leaks in LeakCanary.

Frequency:
Each time on rotation.

Leak #1:

androidx.biometric.DeviceCredentialHandlerBridge
│ Leaking: NO (a class is never leaking)
│ GC Root: System class
│ ↓ static DeviceCredentialHandlerBridge.sInstance
│ ~~~~~~~~~
├─ androidx.biometric.DeviceCredentialHandlerBridge
│ Leaking: UNKNOWN
│ ↓ DeviceCredentialHandlerBridge.mAuthenticationCallback
│ ~~~~~~~~~~~~~~~~~~~~~~~
├─ com.eightbitlab.biometricbugs.MainActivity$onCreate$1
│ Leaking: UNKNOWN
│ Anonymous subclass of androidx.biometric.BiometricPrompt$AuthenticationCallback
│ ↓ MainActivity$onCreate$1.this$0

Leak #2:

┬
├─ androidx.biometric.DeviceCredentialHandlerBridge
│ Leaking: NO (a class is never leaking)
│ GC Root: System class
│ ↓ static DeviceCredentialHandlerBridge.sInstance
│ ~~~~~~~~~
├─ androidx.biometric.DeviceCredentialHandlerBridge
│ Leaking: UNKNOWN
│ ↓ DeviceCredentialHandlerBridge.mOnClickListener
│ ~~~~~~~~~~~~~~~~
├─ androidx.biometric.BiometricPrompt$1
│ Leaking: UNKNOWN
│ Anonymous class implementing android.content.DialogInterface$OnClickListener
│ ↓ BiometricPrompt$1.this$0
│ ~~~~~~
├─ androidx.biometric.BiometricPrompt
│ Leaking: UNKNOWN
│ ↓ BiometricPrompt.mFingerprintDialogFragment
│ ~~~~~~~~~~~~~~~~~~~~~~~~~~
╰→ androidx.biometric.FingerprintDialogFragment
Leaking: YES (Fragment#mFragmentManager is null and ObjectWatcher was watching this)
key = 42dbc3ac-2321-40a0-bfd4-4f74044ca615
watchDurationMillis = 2137697
retainedDurationMillis = 2132696

Another leak, that is not reported by LeakCanary right now is a non-static child of Handler in FingerprintDialogFragment.
Lint gives you a warning:
This Handler class should be static or leaks might occur.