Vaultwarden Updates & Release Notes

Security Fixes

This release contains security fixes for the following advisories. We strongly advise updating as soon as possible.

• Organization member revocation [GHSA-69q9-v8p6-xvx3] (High, 8.1)
• Two-factor authentication [GHSA-7jg8-8m5x-6j9r] (Medium, 6.8)
• Organization invitations [GHSA-v576-3wvq-xh3c] (Medium, 6.8)
• Attachments [GHSA-q5x6-grh5-fqgc] (Medium, 6.5)
• Organization event logs [GHSA-64mc-4p6f-r7x9] (Medium, 4.3)
• Cipher sharing [GHSA-7ccc-c43j-4p36] (Medium, 4.3)
• Organization API key [GHSA-qwx4-wcv4-mpcv] (Low, 3.8)

Additional dependency updates and minor security enhancements

These are private for now, pending CVE assignment and publishing at a later date.

Note

If an organization has Admins you don't fully trust, consider rotating its API key after updating (Admin Console → Settings → Rotate API key). Before this release, Admins could also view the key.

Upgrade notes

Reverse proxies: with IP_HEADER=X-Forwarded-For, the client IP is now the rightmost address that isn't in IP_HEADER_TRUSTED_PROXIES (it used to be the leftmost). If you have several proxies in a row, for example a CDN in front of nginx, add all of them to IP_HEADER_TRUSTED_PROXIES. Otherwise the address of the proxy in front is used for rate limiting and logs.

Sends: bw send receive on CLI 2026.4.2 and older no longer works, the same as against Bitwarden's own servers since v2026.8.0. Creating and managing Sends works on all clients.

Feature flags: these flags were removed because no client reads them anymore: ssh-agent, ssh-key-vault-item, mutual-tls, anon-addy-self-host-alias, simple-login-self-host-alias, pm-25373-windows-biometrics-v2, pm-26340-linux-biometrics-v2, desktop-ui-migration-milestone-1 to -4, cxp-import-mobile and cxp-export-mobile. If EXPERIMENTAL_CLIENT_FEATURE_FLAGS still lists one of them, startup logs a warning and saving settings in the admin panel fails until it's removed.

Duo: DUO_USE_IFRAME (the deprecated Traditional Prompt) is removed and ignored if set.

Custom templates: there's a new email template, email/recover_twofactor, sent after a login with a two-step recovery code.

The legacy POST /identity/accounts/register and POST /api/accounts/prelogin endpoints are removed. No current client uses them.

When using a MariaDB or MySQL server which does not support native TLS/SSL encrypted connections, using the Alpine image of Vaultwarden might fail to connect. Add MARIADB_TLS_DISABLE_PEER_VERIFICATION=1 as an environment variable to your Vaultwarden server environment, and it will start running again.

What's Changed

• [Web 2026.9.0] Support the vault banner policy by @tom27052006 in #7748
• Add support for basic auth response client feature flag by @tom27052006 in #7745
• [web-v2026.8.1] store the user key ID by @Timshel in #7693
• Add organizationsNew and policiesNew to sync response by @tom27052006 in #7666
• Add pm-32009-new-item-types feature flag by @bdd in #7478
• Update Crates, GHA and JS by @BlackDex in #7751
• Add pm-34171-card-scanner feature flag by @bdd in #7477
• set user_created bool for each separate invitation by @stefan0xC in #7753
• Fix revoked org members retaining access to org ciphers by @abhiShandy in #7554
• Ensure all user checked routes are confirmed by @dani-garcia in #7763
• Fix cortex-a53 build issues when using xx-cargo by @BlackDex in #7774
• Add undetermined-cipher-scenario-logic feature flag (closes #7801) by @cad0p in #7802
• Add Windows native credential sync to supported feature flags by @KingIronMan2011 in #7798
• Hide the whole change-email section when EMAIL_CHANGE_ALLOWED is false by @tom27052006 in #7759
• Fix Clippy warnings across all targets by @tom27052006 in #7782
• Admin reset: 2fa email fallback need a verified email by @Timshel in #7770
• Sends cleanup: remove legacy endpoints and align with upstream by @dani-garcia in #7806
• Remove legacy API endpoints and compatibility code by @dani-garcia in #7809
• Align API with upstream and remove unwraps by @dani-garcia in #7810
• Update crates, Rust and other dependencies by @BlackDex in #7814

New Contributors

• @bdd made their first contribution in #7478
• @abhiShandy made their first contribution in #7554
• @cad0p made their first contribution in #7802
• @KingIronMan2011 made their first contribution in #7798

Full Changelog: 1.37.3...1.37.4

Join Discussion

What's Changed

• Fix password change with newer web-vault by @BlackDex in #7634
• chore: remove duplicate "the" in ciphers.rs comment by @mvanhorn in #7254
• Ignore reset-password auto-enroll when mail is disabled by @xhon-pelushi in #7585
• Fix migration for MariaDB 12.2.2 by @Timshel in #7265
• Add SSO_SIGNUPS_ALLOWED by @Timshel in #7272
• log_event take enum parameter not i32 by @Timshel in #7656
• Misc Updates by @BlackDex in #7676
• Update rust docker version by @dani-garcia in #7689
• Fix organization import failing with missing field groups by @tom27052006 in #7699
• Add pm-32413-multi-client-password-management feature flag by @tom27052006 in #7677
• Log IP/username on two-factor email-login credential failures by @crahn in #7654
• Support admin reset 2fa by @Timshel in #7435
• fix(security): revoke 2FA remember tokens when credentials or 2FA change by @BryanFRD in #7682
• fix(security): rate limit prelogin and auth request endpoints by @BryanFRD in #7681
• fix: Correct invalid comment syntax in .dockerignore by @niniconi in #7274
• Update Rust and adjust DockerSettings by @BlackDex in #7690
• Route service clients through shared HTTP setup by @txase in #7639
• Fix iOS registration token response by @tom27052006 in #7714
• Use insert_into when possible by @Timshel in #6437
• Fix archiveDate update by @BlackDex in #7722

New Contributors

• @mvanhorn made their first contribution in #7254
• @xhon-pelushi made their first contribution in #7585
• @crahn made their first contribution in #7654
• @BryanFRD made their first contribution in #7682
• @niniconi made their first contribution in #7274

Full Changelog: 1.37.2...1.37.3

Note

This update is required for support with clients with version 2026.8.0+, please update before reporting any issues with them.

Important

Also read #7615 for more details if you still have client issues!

What's Changed

• Fix Debian cross-linking with xx-cargo by @alexliluz in #7524
• Fix playwright test by @Timshel in #7548
• Misc fixes and updates by @BlackDex in #7558
• Include user email in successful login logs by @lmogthb in #7496
• Fix sendmail executable permission check by @p-boenisch in #7483
• add dummy revisionDate by @stefan0xC in #7608

New Contributors

• @alexliluz made their first contribution in #7524
• @lmogthb made their first contribution in #7496
• @p-boenisch made their first contribution in #7483

Full Changelog: 1.37.1...1.37.2

Note

This patch release resolves the issues with invites.

If you have applied any workaround to fix this locally, please revert those fixes to prevent possible other issues.

I'm sorry that it took some time to check and validate this fix.

Also, this release fixes an issue (#7475) with all the Alpine based images which are build using https://github.com/BlackDex/rust-musl/.

An issue with the build image OpenSSL compilation is resolved and those are used to build the new alpine tagged containers.

What's Changed

Always send initOrganization and orgUserHasExistingUser in invite URL by @vikfox in #7482

Indirectly resolved #7475 by using newer rust-musl build images which had a compilation issue with OpenSSL.

New Contributors

@vikfox made their first contribution in #7482

Full Changelog: 1.37.0...1.37.1

Note

This update is required for support with clients with version 2026.7.0+, please update before reporting any issues with them.

Security Fixes

This release contains security fixes for the following advisories. We strongly advice to update as soon as possible.

• SSRF via the icon endpoint [GHSA-hw4g-2v3f-74x5] [GHSA-vh5m-fc9v-m84g] (Medium, 5.8 / 6.3)
• Cross-Organization Cipher Access [GHSA-xwf8-pjh7-h589] (Medium, 5.9)
• Organization Policy Bypass on Directory Import [GHSA-88qc-6ch9-mc3j] (Medium, 5.5)
• Send Access-Count Bypass [GHSA-rxhg-2pw9-vf25] (Medium, 5.3)
• Unauthenticated WebSocket Flooding DDOS [GHSA-96f7-78q5-j345] (Medium, 5.3)
• Cross-Organization Secret Sharing [GHSA-455c-vgg9-jxw8] (Medium, 4.3)
• Organization Import Authorization [GHSA-f3qw-qg77-hmm4][GHSA-jq2g-h4xr-4mcr] (Medium, 4.3)
• Organization Data Enumeration via the Manager role [GHSA-rqf8-2568-r7mc] (Medium, 4.3)

These are private for now, pending CVE assignment and publishing at a later date.

What's Changed

• OpenDAL S3 parameter support by @txase in #6127
• Fix SSO Cookie path by @BlackDex in #7187
• fix email 2fa for bw cli by @stefan0xC in #7225
• sso_auth improvements by @Timshel in #7197
• Reject unrecognised DATABASE_URL instead of silent SQLite fallback by @mfw78 in #7061
• Switch to xx-cargo by @dfunkt in #6640
• Updates and fixes by @BlackDex in #7235
• Switch to Edition 2024, more clippy lints, and less macro calls by @BlackDex in #7200
• Serve Apple app site association file by @user71424q in #7191
• Update Rust, Crates and GHA by @BlackDex in #7307
• Fix enforce blocked by @Timshel in #7246
• Admin password recovery endpoint change by @Timshel in #7270
• fix(sends): emit hideEmail as non-null boolean in sync response by @kvdb in #7283
• Org membership delete remove Invitation by @Timshel in #7284
• [v2026.5.0] Registration request update by @Timshel in #7295
• [v2026.5.0] PutPolicy now using vnext format by @Timshel in #7296
• 2026.6.0 send support by @Timshel in #7346
• Add SSO_AUTHORIZE_BODY by @Timshel in #7357
• Add pm-26340-linux-biometrics-v2 feature flag by @pilotstew in #7358
• improve CI by @TriplEight in #6991
• Misc updates and fixes by @BlackDex in #7406
• Remove old compatibility code by @Timshel in #7434
• Fix compilation with newer rust-musl version by @dfunkt in #7453
• Fix Custom Role CSS for new dialog markup by @tom27052006 in #7442
• Remove unused fields by @Timshel in #7458
• Update API response, crates and GHA by @BlackDex in #7470
• Trusted proxy support, unauthenticated rate limit & other fixes by @dani-garcia in #7472

New Contributors

• @mfw78 made their first contribution in #7061
• @user71424q made their first contribution in #7191
• @kvdb made their first contribution in #7283
• @pilotstew made their first contribution in #7358
• @TriplEight made their first contribution in #6991
• @tom27052006 made their first contribution in #7442

Full Changelog: 1.36.0...1.37.0

Security Fixes

This release contains security fixes for the following advisories. We strongly advice to update as soon as possible.

SSO Login CSRF

GHSA-pfp2-jhgq-6hg5

GHSA-w6h6-8r66-hcv7

User/Organization Enumeration

GHSA-hxqh-ff5p-wfr3

SSO existing-user binding

GHSA-j4j8-gpvj-7fqr

GHSA-6x5c-84vm-5j56

SSRF via Icon Endpoint

GHSA-72vh-x5jq-m82g

Some crate's updated and other minor security enhancements

These are private for now, pending CVE assignment.

Notes

Archiving of items is available

https://bitwarden.com/blog/keep-your-vault-tidy-with-item-archiving/

https://bitwarden.com/nl-nl/help/managing-items/#archive

Web Vault updated to v2026.4.1

What's Changed

• SSO fallback to UserInfo preferred_username by @Timshel in #7128
• Dummy identifier need to pass for a guid by @Timshel in #7154
• add new /identity/accounts/prelogin/password by @stefan0xC in #7156
• Add DuckDuckGo browser device type by @dfunkt in #7147
• Apply duration_suboptimal_units lint findings by @dfunkt in #7144
• Apply ref_option lint findings by @dfunkt in #7143
• Fix hardcoded sso identifier by @Timshel in #7157
• Update crates and fix a nightly lint by @BlackDex in #7161
• Fix Host/IP resolving by @BlackDex in #7162
• Several SSO Fixes by @BlackDex in #7163
• Add support for archiving items by @matt-aaron in #6916
• Fix favicon fetching to check all icon links instead of just the first one by @Shocker in #6880
• Fix merge conflict by @dani-garcia in #7164
• Replace organization_uuid unwrap with proper error handling by @xjohnyknox in #6936
• fix: return Err instead of panic on unknown cipher atype in to_json() by @mango766 in #7068
• Allow SQLite to be linked against dynamically by @ISSOtm in #7057
• Update crates and web-vault by @BlackDex in #7171
• Update hickory by @BlackDex in #7175

New Contributors

• @matt-aaron made their first contribution in #6916
• @Shocker made their first contribution in #6880
• @xjohnyknox made their first contribution in #6936
• @mango766 made their first contribution in #7068
• @ISSOtm made their first contribution in #7057

Full Changelog: 1.35.8...1.36.0

You can discuss this release here #7177

Security Fixes

This release contains security fixes for the following advisories. We strongly advice to update as soon as possible.

GHSA-937x-3j8m-7w7p Unconfirmed Owner Can Purge Entire Organization Vault.

GHSA-569v-845w-g82p Cross-Org Group Binding Enables Unauthorized Read And Write Access Into Another Organization

GHSA-6j4w-g4jh-xjfx Refresh tokens not invalidated on security stamp rotation

These are private for now, pending CVE assignment.

Notes

The admin templates have changed, please update them if you override these via templates.

Two Factor Remember Tokens are now valid for max 30 days. Old tokens are invalid directly after upgrading.

What's Changed

• apply policies only to confirmed members by @stefan0xC in #6892
• Feat(config): add feature flag for Safari account switching by @DerPlayer2001 in #6891
• fix: add ForcePasswordReset to api key login by @montdidier in #6904
• Add Webauthn related origins flag to known flags. by @pasarenicu in #6900
• Add 30s cache to SSO exchange_refresh_token by @Timshel in #6866
• Add cxp-import-mobile and cxp-export-mobile: feature flags on mobile by @phoeagon in #6853
• Misc updates and fixes by @BlackDex in #6910
• Support new desktop origin on CORS by @dani-garcia in #6920
• Fix checkout action version by @dfunkt in #6921
• Fix apikey login by @BlackDex in #6922
• Fix email header base64 padding by @BlackDex in #6961
• Update Feature Flags by @BlackDex in #6981
• Update crates and GHA by @BlackDex in #6980
• Use protected CI environment by @dani-garcia in #7004
• Fix 2FA Remember to actually be 30 days by @BlackDex in #6929
• Misc Updates by @BlackDex in #7027
• Switch to attest action by @dfunkt in #7017
• Rotate refresh-tokens on sstamp reset by @BlackDex in #7031
• Misc org fixes by @BlackDex in #7032
• Fix empty string FolderId by @BlackDex in #7048
• Disable deployments for release env by @dfunkt in #7033
• Fix Send icons by @BlackDex in #7051
• prevent managers from creating collections by @stefan0xC in #6890
• Change SQLite backup to use VACUUM INTO query by @getaaron in #6989
• Handle SIGTERM and SIGQUIT shutdown signals. by @0x484558 in #7008
• Do not display unavailable 2FA options by @0x484558 in #7013
• Fix logout push identifiers and send logout before clearing devices by @qaz741wsd856 in #7047
• Fix windows build issues by @idontneedonetho in #7065
• Crate and GHA updates by @BlackDex in #7081

New Contributors

• @DerPlayer2001 made their first contribution in #6891
• @montdidier made their first contribution in #6904
• @pasarenicu made their first contribution in #6900
• @phoeagon made their first contribution in #6853
• @getaaron made their first contribution in #6989
• @0x484558 made their first contribution in #7008
• @qaz741wsd856 made their first contribution in #7047
• @idontneedonetho made their first contribution in #7065

Full Changelog: 1.35.4...1.35.5

Security Fixes

This release contains security fixes for the following advisories. We strongly advice to update as soon as possible.
GHSA-w9f8-m526-h7fh. This vulnerability would allow an attacker to access a cipher from a different user (fully encrypted) if they already know its internal UUID.
GHSA-h4hq-rgvh-wh27. This vulnerability allows an attacker with manager-level access within an organization to modify collections they can access, even if they do not have management permissions for them.
GHSA-r32r-j5jq-3w4m. This vulnerability allows an attacker with manager-level access within an organization to modify collections they are not assigned.
These are private for now, pending CVE assignment.

What's Changed

• Update Rust and Crates and GHA by @BlackDex in #6843
• hide remember 2fa token by @stefan0xC in #6852
• fix(send_invite): invite links by @proofofcopilot in #6824
• Misc organization fixes by @BlackDex in #6867

New Contributors

• @proofofcopilot made their first contribution in #6824

Full Changelog: 1.35.3...1.35.4

Security Fixes

This release contains security fixes for the following advisory. We strongly advice to update as soon as possible if you believe it could affect you.

GHSA-h265-g7rm-h337 (Publication in process, waiting for CVE assignment)
This vulnerability would allow an authenticated attacker that is part of an organization to access items from collections to which the attacker does not belong.

What's Changed

• Fix User API Key login by @BlackDex in #6712
• use email instead of empty name for webauhn by @stefan0xC in #6733
• hide password hints via CSS by @stefan0xC in #6726
• fix email as 2fa with auth requests by @stefan0xC in #6736
• Update crates, web-vault, js, workflows by @BlackDex in #6749
• refactor: improve tooltips in diagnostics page by @tessus in #6765
• Empty AccountKeys when no private key by @Timshel in #6761
• fix error message for purging auth requests by @stefan0xC in #6776
• Misc updates, crates, rust, js, gha, vault by @BlackDex in #6799
• Update crates and web-vault by @BlackDex in #6810
• Fix org-details issue by @BlackDex in #6811

Full Changelog: 1.35.2...1.35.3