Vaultwarden

Security & PrivacyAGPL-3.0

An unofficial Bitwarden-compatible server written in Rust.

Latest 1.37.2 · by Daniel GarcíaWritten in RustWebsitedani-garcia/vaultwardenRSS

Release activity

Release activity — 11 releases across 10 days since Jan 9, 2026. Each cell is one day; darker means more releases that day. Nothing is recorded before Jan 9, 2026. Older weeks are hidden at this screen width.
JunJulAugSep
SundayNo releases on May 24, 2026No releases on May 31, 2026No releases on Jun 7, 2026No releases on Jun 14, 2026No releases on Jun 21, 2026No releases on Jun 28, 2026No releases on Jul 5, 2026No releases on Jul 12, 2026No releases on Jul 19, 2026No releases on Jul 26, 2026No releases on Aug 2, 2026No releases on Aug 9, 2026No releases on Aug 16, 2026No releases on Aug 23, 2026No releases on Aug 30, 2026No releases on Sep 6, 2026
MondayNo releases on May 25, 2026No releases on Jun 1, 2026No releases on Jun 8, 2026No releases on Jun 15, 2026No releases on Jun 22, 2026No releases on Jun 29, 2026No releases on Jul 6, 2026No releases on Jul 13, 2026No releases on Jul 20, 2026No releases on Jul 27, 2026No releases on Aug 3, 2026No releases on Aug 10, 2026No releases on Aug 17, 2026No releases on Aug 24, 2026No releases on Aug 31, 2026No releases on Sep 7, 2026
TuesdayNo releases on May 26, 2026No releases on Jun 2, 2026No releases on Jun 9, 2026No releases on Jun 16, 2026No releases on Jun 23, 2026No releases on Jun 30, 2026No releases on Jul 7, 2026No releases on Jul 14, 2026No releases on Jul 21, 2026No releases on Jul 28, 2026No releases on Aug 4, 2026No releases on Aug 11, 2026No releases on Aug 18, 2026No releases on Aug 25, 2026No releases on Sep 1, 2026No releases on Sep 8, 2026
WednesdayNo releases on May 27, 2026No releases on Jun 3, 2026No releases on Jun 10, 2026No releases on Jun 17, 2026No releases on Jun 24, 2026No releases on Jul 1, 2026No releases on Jul 8, 2026No releases on Jul 15, 2026No releases on Jul 22, 20261 release on Jul 29, 2026No releases on Aug 5, 2026No releases on Aug 12, 2026No releases on Aug 19, 2026No releases on Aug 26, 2026No releases on Sep 2, 2026
ThursdayNo releases on May 28, 2026No releases on Jun 4, 2026No releases on Jun 11, 2026No releases on Jun 18, 2026No releases on Jun 25, 2026No releases on Jul 2, 2026No releases on Jul 9, 2026No releases on Jul 16, 2026No releases on Jul 23, 2026No releases on Jul 30, 2026No releases on Aug 6, 2026No releases on Aug 13, 2026No releases on Aug 20, 2026No releases on Aug 27, 2026No releases on Sep 3, 2026
FridayNo releases on May 29, 2026No releases on Jun 5, 2026No releases on Jun 12, 2026No releases on Jun 19, 2026No releases on Jun 26, 2026No releases on Jul 3, 2026No releases on Jul 10, 2026No releases on Jul 17, 20261 release on Jul 24, 2026No releases on Jul 31, 2026No releases on Aug 7, 2026No releases on Aug 14, 2026No releases on Aug 21, 2026No releases on Aug 28, 2026No releases on Sep 4, 2026
SaturdayNo releases on May 30, 2026No releases on Jun 6, 2026No releases on Jun 13, 2026No releases on Jun 20, 2026No releases on Jun 27, 2026No releases on Jul 4, 2026No releases on Jul 11, 2026No releases on Jul 18, 2026No releases on Jul 25, 2026No releases on Aug 1, 2026No releases on Aug 8, 2026No releases on Aug 15, 20261 release on Aug 22, 2026No releases on Aug 29, 2026No releases on Sep 5, 2026

11 releases since Jan 9, 2026, busiest day 2

Changelog

1.37.2

Latest
Added 1
  • Add dummy revisionDate
Changed 2
  • Misc fixes and updates
  • Include user email in successful login logs
Fixed 3
  • Fix Debian cross-linking with xx-cargo
  • Fix playwright test
  • Fix sendmail executable permission check

From Vaultwarden

Note

This update is required for support with clients with version 2026.8.0+, please update before reporting any issues with them.

[!IMPORTANT] Also read #7615 for more details if you still have client issues!

What's Changed
New Contributors

Full Changelog: https://github.com/dani-garcia/vaultwarden/compare/1.37.1...1.37.2

View originalPermalink
How 1.37.2 went

1.37.1

Fixed 2
  • Resolve issues with invites by always sending initOrganization and orgUserHasExistingUser in invite URL
  • Fix Alpine based image build issue with OpenSSL compilation by using newer rust-musl build images

From Vaultwarden

Note

This patch release resolves the issues with invites. If you have applied any workaround to fix this locally, please revert those fixes to prevent possible other issues.

I'm sorry that it took some time to check and validate this fix.

Also, this release fixes an issue (#7475) with all the Alpine based images which are build using https://github.com/BlackDex/rust-musl/. An issue with the build image OpenSSL compilation is resolved and those are used to build the new alpine tagged containers.

What's Changed
New Contributors

Full Changelog: https://github.com/dani-garcia/vaultwarden/compare/1.37.0...1.37.1

View originalPermalink
How 1.37.1 went

1.37.0

Added 5
  • Add OpenDAL S3 parameter support
  • Serve Apple app site association file
  • Add SSO_AUTHORIZE_BODY configuration option
  • Add pm-26340-linux-biometrics-v2 feature flag
  • Add trusted proxy support and unauthenticated rate limit
Changed 2
  • Reject unrecognised DATABASE_URL instead of silent SQLite fallback
  • Switch to Rust Edition 2024
Fixed 6
  • Fix SSO Cookie path
  • Fix email 2fa for bw cli
  • Fix enforce blocked
  • Fix hideEmail as non-null boolean in sync response
  • Fix Custom Role CSS for new dialog markup
  • Fix compilation with newer rust-musl version
Security 8
  • Fix SSRF via the icon endpoint
  • Fix Cross-Organization Cipher Access
  • Fix Organization Policy Bypass on Directory Import
  • Fix Send Access-Count Bypass
  • Fix Unauthenticated WebSocket Flooding DDOS
  • Fix Cross-Organization Secret Sharing
  • Fix Organization Import Authorization
  • Fix Organization Data Enumeration via the Manager role

From Vaultwarden

Note

This update is required for support with clients with version 2026.7.0+, please update before reporting any issues with them.

Security Fixes

This release contains security fixes for the following advisories. We strongly advice to update as soon as possible.

These are private for now, pending CVE assignment and publishing at a later date.

What's Changed
New Contributors

Full Changelog: https://github.com/dani-garcia/vaultwarden/compare/1.36.0...1.37.0

View originalPermalink
How 1.37.0 went

1.36.0

Added 3
  • Add support for archiving items
  • Add new /identity/accounts/prelogin/password endpoint
  • Add DuckDuckGo browser device type
Changed 4
  • Update web vault to v2026.4.1
  • SSO fallback to UserInfo preferred_username
  • Allow SQLite to be linked against dynamically
  • Update hickory dependency
Fixed 5
  • Fix hardcoded SSO identifier
  • Fix host and IP resolving
  • Fix favicon fetching to check all icon links instead of just the first one
  • Replace organization_uuid unwrap with proper error handling
  • Return error instead of panic on unknown cipher atype in to_json
Security 5
  • Fix SSO login CSRF vulnerability
  • Fix user and organization enumeration vulnerability
  • Fix SSO existing-user binding vulnerability
  • Fix SSRF vulnerability via icon endpoint
  • Update crates and apply minor security enhancements

From Vaultwarden

Security Fixes

This release contains security fixes for the following advisories. We strongly advice to update as soon as possible.

These are private for now, pending CVE assignment.

Notes
What's Changed
New Contributors

Full Changelog: https://github.com/dani-garcia/vaultwarden/compare/1.35.8...1.36.0

You can discuss this release here https://github.com/dani-garcia/vaultwarden/discussions/7177

View originalPermalink
How 1.36.0 went

1.35.8

Changed 2
  • Update Rust, Crates, and GHA
  • Update web-vault and crates
Fixed 4
  • Fix dummy org Master password policy authentication
  • Fix recovery-code not working
  • Fix invalid refresh token response
  • Fix a DNS issue

From Vaultwarden

What's Changed

Full Changelog: https://github.com/dani-garcia/vaultwarden/compare/1.35.7...1.35.8

View originalPermalink
How 1.35.8 went

1.35.6

Fixed 1
  • Two Factor Remember Tokens and Recovery Tokens are now accepted

From Vaultwarden

Notes

The previous release contained an issue where Two Factor Remember Tokens and Recovery Tokens were not accepted at all. This has been fixed now in this release.

What's Changed

Full Changelog: https://github.com/dani-garcia/vaultwarden/compare/1.35.5...1.35.6

View originalPermalink
How 1.35.6 went

1.35.5

Added 5
  • Add feature flag for Safari account switching
  • Add Webauthn related origins flag to known flags
  • Add 30-second cache to SSO exchange_refresh_token
  • Add cxp-import-mobile and cxp-export-mobile feature flags on mobile
  • Handle SIGTERM and SIGQUIT shutdown signals
Changed 3
  • Support new desktop origin on CORS
  • Two Factor Remember Tokens are now valid for maximum 30 days
  • Change SQLite backup to use VACUUM INTO query
Fixed 9
  • Apply policies only to confirmed members
  • Add ForcePasswordReset to API key login
  • Fix API key login
  • Fix email header base64 padding
  • Fix empty string FolderId
  • Fix Send icons
Security 3
  • Fix unconfirmed owner ability to purge entire organization vault
  • Fix cross-org group binding that enabled unauthorized read and write access into another organization
  • Invalidate refresh tokens on security stamp rotation

From Vaultwarden

Security Fixes

This release contains security fixes for the following advisories. We strongly advice to update as soon as possible.

These are private for now, pending CVE assignment.

Notes
  • The admin templates have changed, please update them if you override these via templates.
  • Two Factor Remember Tokens are now valid for max 30 days. Old tokens are invalid directly after upgrading.
What's Changed
New Contributors

Full Changelog: https://github.com/dani-garcia/vaultwarden/compare/1.35.4...1.35.5

View originalPermalink
How 1.35.5 went

1.35.4

Changed 2
  • Hide remember 2FA token
  • Miscellaneous organization fixes
Fixed 1
  • Fix invite links in send invitations
Security 3
  • Fix vulnerability allowing an attacker to access a cipher from a different user if they know its internal UUID
  • Fix vulnerability allowing an attacker with manager-level access within an organization to modify collections they can access without management permissions
  • Fix vulnerability allowing an attacker with manager-level access within an organization to modify collections they are not assigned

From Vaultwarden

Security Fixes

This release contains security fixes for the following advisories. We strongly advice to update as soon as possible.

  • GHSA-w9f8-m526-h7fh. This vulnerability would allow an attacker to access a cipher from a different user (fully encrypted) if they already know its internal UUID.
  • GHSA-h4hq-rgvh-wh27. This vulnerability allows an attacker with manager-level access within an organization to modify collections they can access, even if they do not have management permissions for them.
  • GHSA-r32r-j5jq-3w4m. This vulnerability allows an attacker with manager-level access within an organization to modify collections they are not assigned.

These are private for now, pending CVE assignment.

What's Changed
New Contributors

Full Changelog: https://github.com/dani-garcia/vaultwarden/compare/1.35.3...1.35.4

View originalPermalink
How 1.35.4 went

1.35.3

Changed 2
  • Improve tooltips in diagnostics page
  • Update crates, web-vault, and JavaScript dependencies
Fixed 7
  • Fix User API Key login
  • Use email instead of empty name for WebAuthn
  • Hide password hints via CSS
  • Fix email as 2FA with auth requests
  • Empty AccountKeys when no private key
  • Fix error message for purging auth requests
  • Fix org-details issue
Security 1
  • Fix vulnerability allowing authenticated attackers in an organization to access items from collections they do not belong to (GHSA-h265-g7rm-h337)

From Vaultwarden

Security Fixes

This release contains security fixes for the following advisory. We strongly advice to update as soon as possible if you believe it could affect you.

  • GHSA-h265-g7rm-h337 (Publication in process, waiting for CVE assignment) This vulnerability would allow an authenticated attacker that is part of an organization to access items from collections to which the attacker does not belong.
What's Changed

Full Changelog: https://github.com/dani-garcia/vaultwarden/compare/1.35.2...1.35.3

View originalPermalink
How 1.35.3 went

1.35.2

Changed 2
  • Allow MasterPasswordHash for Android
  • Improve SSO callback path
Fixed 3
  • Fix an issue with the web-vault which prevented creating an organization
  • Return no content with status code 204
  • Fix web-vault version check and update web-vault

From Vaultwarden

Notable changes

Fixed an issue with the web-vault which prevent creating an organization.

What's Changed

Full Changelog: https://github.com/dani-garcia/vaultwarden/compare/1.35.1...1.35.2

View originalPermalink
How 1.35.2 went

More in Security & Privacy

View all
Shadowrocket

Rule based proxy utility client for iPhone/iPad.

Shadow Launch Technology Limited
fanqiang

fanqiang release notes.

fanqiang
Magisk

The systemless rooting suite for Android, with modules and root hiding.

John Wu
uBlock Origin

The efficient, wide-spectrum content blocker for your browser.

Raymond Hill
v2rayNG

A V2Ray client for Android, support Xray core and v2fly core

2dust
Pi-hole

A DNS sinkhole that protects devices from unwanted content.

Pi-hole

Discussion

If you publish Vaultwarden, you can claim this product by proving you administer its repository.