Vaultwarden

Developer Tools

An unofficial Bitwarden-compatible server written in Rust.

Latest 1.37.1 · by Daniel GarcíaWebsitedani-garcia/vaultwarden

Release activity

Release activity — 10 releases across 9 days since Jan 9, 2026. Each cell is one day; darker means more releases that day. Nothing is recorded before Jan 9, 2026. Older weeks are hidden at this screen width.
MayJunJulAug
SundayNo releases on Apr 19, 2026No releases on Apr 26, 20261 release on May 3, 2026No releases on May 10, 2026No releases on May 17, 2026No releases on May 24, 2026No releases on May 31, 2026No releases on Jun 7, 2026No releases on Jun 14, 2026No releases on Jun 21, 2026No releases on Jun 28, 2026No releases on Jul 5, 2026No releases on Jul 12, 2026No releases on Jul 19, 2026No releases on Jul 26, 2026No releases on Aug 2, 2026
MondayNo releases on Apr 20, 2026No releases on Apr 27, 2026No releases on May 4, 2026No releases on May 11, 2026No releases on May 18, 2026No releases on May 25, 2026No releases on Jun 1, 2026No releases on Jun 8, 2026No releases on Jun 15, 2026No releases on Jun 22, 2026No releases on Jun 29, 2026No releases on Jul 6, 2026No releases on Jul 13, 2026No releases on Jul 20, 2026No releases on Jul 27, 2026No releases on Aug 3, 2026
TuesdayNo releases on Apr 21, 2026No releases on Apr 28, 2026No releases on May 5, 2026No releases on May 12, 2026No releases on May 19, 2026No releases on May 26, 2026No releases on Jun 2, 2026No releases on Jun 9, 2026No releases on Jun 16, 2026No releases on Jun 23, 2026No releases on Jun 30, 2026No releases on Jul 7, 2026No releases on Jul 14, 2026No releases on Jul 21, 2026No releases on Jul 28, 2026No releases on Aug 4, 2026
WednesdayNo releases on Apr 22, 2026No releases on Apr 29, 2026No releases on May 6, 2026No releases on May 13, 2026No releases on May 20, 2026No releases on May 27, 2026No releases on Jun 3, 2026No releases on Jun 10, 2026No releases on Jun 17, 2026No releases on Jun 24, 2026No releases on Jul 1, 2026No releases on Jul 8, 2026No releases on Jul 15, 2026No releases on Jul 22, 20261 release on Jul 29, 2026No releases on Aug 5, 2026
ThursdayNo releases on Apr 23, 2026No releases on Apr 30, 2026No releases on May 7, 2026No releases on May 14, 2026No releases on May 21, 2026No releases on May 28, 2026No releases on Jun 4, 2026No releases on Jun 11, 2026No releases on Jun 18, 2026No releases on Jun 25, 2026No releases on Jul 2, 2026No releases on Jul 9, 2026No releases on Jul 16, 2026No releases on Jul 23, 2026No releases on Jul 30, 2026No releases on Aug 6, 2026
FridayNo releases on Apr 24, 2026No releases on May 1, 2026No releases on May 8, 2026No releases on May 15, 2026No releases on May 22, 2026No releases on May 29, 2026No releases on Jun 5, 2026No releases on Jun 12, 2026No releases on Jun 19, 2026No releases on Jun 26, 2026No releases on Jul 3, 2026No releases on Jul 10, 2026No releases on Jul 17, 20261 release on Jul 24, 2026No releases on Jul 31, 2026No releases on Aug 7, 2026
Saturday1 release on Apr 25, 2026No releases on May 2, 2026No releases on May 9, 2026No releases on May 16, 2026No releases on May 23, 2026No releases on May 30, 2026No releases on Jun 6, 2026No releases on Jun 13, 2026No releases on Jun 20, 2026No releases on Jun 27, 2026No releases on Jul 4, 2026No releases on Jul 11, 2026No releases on Jul 18, 2026No releases on Jul 25, 2026No releases on Aug 1, 2026

10 releases since Jan 9, 2026, busiest day 2

Changelog

1.37.1

Fixed 2
  • Resolve issues with invites by always sending initOrganization and orgUserHasExistingUser in invite URL
  • Fix Alpine based image build issue with OpenSSL compilation by using newer rust-musl build images
Note

This patch release resolves the issues with invites. If you have applied any workaround to fix this locally, please revert those fixes to prevent possible other issues.

I'm sorry that it took some time to check and validate this fix.

Also, this release fixes an issue (#7475) with all the Alpine based images which are build using https://github.com/BlackDex/rust-musl/. An issue with the build image OpenSSL compilation is resolved and those are used to build the new alpine tagged containers.

What's Changed
New Contributors

Full Changelog: https://github.com/dani-garcia/vaultwarden/compare/1.37.0...1.37.1

View originalPermalink
How 1.37.1 went

1.37.0

Added 5
  • Add OpenDAL S3 parameter support
  • Serve Apple app site association file
  • Add SSO_AUTHORIZE_BODY configuration option
  • Add pm-26340-linux-biometrics-v2 feature flag
  • Add trusted proxy support and unauthenticated rate limit
Changed 2
  • Reject unrecognised DATABASE_URL instead of silent SQLite fallback
  • Switch to Rust Edition 2024
Fixed 6
  • Fix SSO Cookie path
  • Fix email 2fa for bw cli
  • Fix enforce blocked
  • Fix hideEmail as non-null boolean in sync response
  • Fix Custom Role CSS for new dialog markup
  • Fix compilation with newer rust-musl version
Security 8
  • Fix SSRF via the icon endpoint
  • Fix Cross-Organization Cipher Access
  • Fix Organization Policy Bypass on Directory Import
  • Fix Send Access-Count Bypass
  • Fix Unauthenticated WebSocket Flooding DDOS
  • Fix Cross-Organization Secret Sharing
  • Fix Organization Import Authorization
  • Fix Organization Data Enumeration via the Manager role
Note

This update is required for support with clients with version 2026.7.0+, please update before reporting any issues with them.

Security Fixes

This release contains security fixes for the following advisories. We strongly advice to update as soon as possible.

These are private for now, pending CVE assignment and publishing at a later date.

What's Changed
New Contributors

Full Changelog: https://github.com/dani-garcia/vaultwarden/compare/1.36.0...1.37.0

View originalPermalink
How 1.37.0 went

1.36.0

Added 3
  • Add support for archiving items
  • Add new /identity/accounts/prelogin/password endpoint
  • Add DuckDuckGo browser device type
Changed 4
  • Update web vault to v2026.4.1
  • SSO fallback to UserInfo preferred_username
  • Allow SQLite to be linked against dynamically
  • Update hickory dependency
Fixed 5
  • Fix hardcoded SSO identifier
  • Fix host and IP resolving
  • Fix favicon fetching to check all icon links instead of just the first one
  • Replace organization_uuid unwrap with proper error handling
  • Return error instead of panic on unknown cipher atype in to_json
Security 5
  • Fix SSO login CSRF vulnerability
  • Fix user and organization enumeration vulnerability
  • Fix SSO existing-user binding vulnerability
  • Fix SSRF vulnerability via icon endpoint
  • Update crates and apply minor security enhancements
Security Fixes

This release contains security fixes for the following advisories. We strongly advice to update as soon as possible.

These are private for now, pending CVE assignment.

Notes
What's Changed
New Contributors

Full Changelog: https://github.com/dani-garcia/vaultwarden/compare/1.35.8...1.36.0

You can discuss this release here https://github.com/dani-garcia/vaultwarden/discussions/7177

View originalPermalink
How 1.36.0 went

1.35.8

Changed 2
  • Update Rust, Crates, and GHA
  • Update web-vault and crates
Fixed 4
  • Fix dummy org Master password policy authentication
  • Fix recovery-code not working
  • Fix invalid refresh token response
  • Fix a DNS issue
What's Changed

Full Changelog: https://github.com/dani-garcia/vaultwarden/compare/1.35.7...1.35.8

View originalPermalink
How 1.35.8 went

1.35.6

Fixed 1
  • Two Factor Remember Tokens and Recovery Tokens are now accepted
Notes

The previous release contained an issue where Two Factor Remember Tokens and Recovery Tokens were not accepted at all. This has been fixed now in this release.

What's Changed

Full Changelog: https://github.com/dani-garcia/vaultwarden/compare/1.35.5...1.35.6

View originalPermalink
How 1.35.6 went

1.35.5

Added 5
  • Add feature flag for Safari account switching
  • Add Webauthn related origins flag to known flags
  • Add 30-second cache to SSO exchange_refresh_token
  • Add cxp-import-mobile and cxp-export-mobile feature flags on mobile
  • Handle SIGTERM and SIGQUIT shutdown signals
Changed 3
  • Support new desktop origin on CORS
  • Two Factor Remember Tokens are now valid for maximum 30 days
  • Change SQLite backup to use VACUUM INTO query
Fixed 9
  • Apply policies only to confirmed members
  • Add ForcePasswordReset to API key login
  • Fix API key login
  • Fix email header base64 padding
  • Fix empty string FolderId
  • Fix Send icons
Security 3
  • Fix unconfirmed owner ability to purge entire organization vault
  • Fix cross-org group binding that enabled unauthorized read and write access into another organization
  • Invalidate refresh tokens on security stamp rotation
Security Fixes

This release contains security fixes for the following advisories. We strongly advice to update as soon as possible.

These are private for now, pending CVE assignment.

Notes
  • The admin templates have changed, please update them if you override these via templates.
  • Two Factor Remember Tokens are now valid for max 30 days. Old tokens are invalid directly after upgrading.
What's Changed
New Contributors

Full Changelog: https://github.com/dani-garcia/vaultwarden/compare/1.35.4...1.35.5

View originalPermalink
How 1.35.5 went

1.35.4

Changed 2
  • Hide remember 2FA token
  • Miscellaneous organization fixes
Fixed 1
  • Fix invite links in send invitations
Security 3
  • Fix vulnerability allowing an attacker to access a cipher from a different user if they know its internal UUID
  • Fix vulnerability allowing an attacker with manager-level access within an organization to modify collections they can access without management permissions
  • Fix vulnerability allowing an attacker with manager-level access within an organization to modify collections they are not assigned
Security Fixes

This release contains security fixes for the following advisories. We strongly advice to update as soon as possible.

  • GHSA-w9f8-m526-h7fh. This vulnerability would allow an attacker to access a cipher from a different user (fully encrypted) if they already know its internal UUID.
  • GHSA-h4hq-rgvh-wh27. This vulnerability allows an attacker with manager-level access within an organization to modify collections they can access, even if they do not have management permissions for them.
  • GHSA-r32r-j5jq-3w4m. This vulnerability allows an attacker with manager-level access within an organization to modify collections they are not assigned.

These are private for now, pending CVE assignment.

What's Changed
New Contributors

Full Changelog: https://github.com/dani-garcia/vaultwarden/compare/1.35.3...1.35.4

View originalPermalink
How 1.35.4 went

1.35.3

Changed 2
  • Improve tooltips in diagnostics page
  • Update crates, web-vault, and JavaScript dependencies
Fixed 7
  • Fix User API Key login
  • Use email instead of empty name for WebAuthn
  • Hide password hints via CSS
  • Fix email as 2FA with auth requests
  • Empty AccountKeys when no private key
  • Fix error message for purging auth requests
  • Fix org-details issue
Security 1
  • Fix vulnerability allowing authenticated attackers in an organization to access items from collections they do not belong to (GHSA-h265-g7rm-h337)
Security Fixes

This release contains security fixes for the following advisory. We strongly advice to update as soon as possible if you believe it could affect you.

  • GHSA-h265-g7rm-h337 (Publication in process, waiting for CVE assignment) This vulnerability would allow an authenticated attacker that is part of an organization to access items from collections to which the attacker does not belong.
What's Changed

Full Changelog: https://github.com/dani-garcia/vaultwarden/compare/1.35.2...1.35.3

View originalPermalink
How 1.35.3 went

1.35.2

Changed 2
  • Allow MasterPasswordHash for Android
  • Improve SSO callback path
Fixed 3
  • Fix an issue with the web-vault which prevented creating an organization
  • Return no content with status code 204
  • Fix web-vault version check and update web-vault
Notable changes

Fixed an issue with the web-vault which prevent creating an organization.

What's Changed

Full Changelog: https://github.com/dani-garcia/vaultwarden/compare/1.35.1...1.35.2

View originalPermalink
How 1.35.2 went

More in Developer Tools

View all
yt-dlp

A feature-rich command-line audio/video downloader

yt-dlp
tmux

tmux release notes.

tmux
Claude Code

Anthropic's agentic coding tool for the terminal, IDE and web.

Anthropic
Shadowrocket

Rule based proxy utility client for iPhone/iPad.

Shadow Launch Technology Limited
AWS CLI

One tool to manage every AWS service from the command line, and script them.

Amazon Web Services
Microsoft-Activation-Scripts

Open-source Windows and Office activator featuring HWID, Ohook, TSforge, and Online KMS activation methods, along with advanced troubleshooting.

massgravel

Discussion