# Vaultwarden changelog

> An unofficial Bitwarden-compatible server written in Rust.

- Vendor: Daniel García
- Category: Security & Privacy
- License: AGPL-3.0
- Language: Rust
- Official site: https://github.com/dani-garcia/vaultwarden
- Tracked by: What's New (https://whatsnew.fyi/product/vaultwarden)
- Harvested from: GitHub (dani-garcia/vaultwarden)
- Entries below: 13 (newest first)

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: release facts (products, versions, dates, links, CVE ids and flags) are open data under CC BY 4.0, from the API at https://whatsnew.fyi/api/v1 or the nightly dataset at https://github.com/whatsnew-fyi/dataset. The summaries, labels and curation are © What's New: quote freely with attribution and a link back; wholesale republication of them is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

## Releases

### 1.37.4

- Date: 2026-10-05
- Version: 1.37.4
- Original notes: https://github.com/dani-garcia/vaultwarden/releases/tag/1.37.4
- Permalink: https://whatsnew.fyi/product/vaultwarden/releases/1.37.4

- **security** — Fix organization member revocation vulnerability allowing revoked members to retain access to organization ciphers
- **security** — Fix two-factor authentication vulnerability
- **security** — Fix organization invitations vulnerability
- **security** — Fix attachments vulnerability
- **security** — Fix organization event logs vulnerability
- **security** — Fix cipher sharing vulnerability
- **security** — Fix organization API key visibility to admins
- **changed** — When using IP_HEADER=X-Forwarded-For, client IP is now the rightmost address that is not in IP_HEADER_TRUSTED_PROXIES instead of the leftmost
- **removed** — Remove support for bw send receive command on CLI 2026.4.2 and older
- **removed** — Remove feature flags ssh-agent, ssh-key-vault-item, mutual-tls, anon-addy-self-host-alias, simple-login-self-host-alias, pm-25373-windows-biometrics-v2, pm-26340-linux-biometrics-v2, desktop-ui-migration-milestone-1 to -4, cxp-import-mobile and cxp-export-mobile
- **removed** — Remove DUO_USE_IFRAME deprecated Traditional Prompt configuration
- **removed** — Remove legacy POST /identity/accounts/register and POST /api/accounts/prelogin endpoints
- **added** — Add new email template email/recover_twofactor sent after login with two-step recovery code
- **added** — Support vault banner policy
- **added** — Add support for basic auth response client feature flag
- **added** — Add pm-32009-new-item-types feature flag
- **added** — Add pm-34171-card-scanner feature flag
- **added** — Add undetermined-cipher-scenario-logic feature flag
- **added** — Add Windows native credential sync to supported feature flags
- **changed** — Store user key ID in sync response
- **changed** — Add organizationsNew and policiesNew to sync response
- **changed** — Hide change-email section when EMAIL_CHANGE_ALLOWED is false
- **fixed** — Fix admin reset two-factor email fallback to require verified email

##### Security Fixes
This release contains security fixes for the following advisories. We strongly advise updating as soon as possible.
- Organization member revocation [[GHSA-69q9-v8p6-xvx3]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-69q9-v8p6-xvx3) (**High**, 8.1)
- Two-factor authentication [[GHSA-7jg8-8m5x-6j9r]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-7jg8-8m5x-6j9r) (**Medium**, 6.8)
- Organization invitations [[GHSA-v576-3wvq-xh3c]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-v576-3wvq-xh3c) (**Medium**, 6.8)
- Attachments [[GHSA-q5x6-grh5-fqgc]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-q5x6-grh5-fqgc) (**Medium**, 6.5)
- Organization event logs [[GHSA-64mc-4p6f-r7x9]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-64mc-4p6f-r7x9) (**Medium**, 4.3)
- Cipher sharing [[GHSA-7ccc-c43j-4p36]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-7ccc-c43j-4p36) (**Medium**, 4.3)
- Organization API key [[GHSA-qwx4-wcv4-mpcv]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-qwx4-wcv4-mpcv) (**Low**, 3.8)
- Additional dependency updates and minor security enhancements

These are private for now, pending CVE assignment and publishing at a later date.

> [!NOTE]
> If an organization has Admins you don't fully trust, consider rotating its API key after updating (Admin Console → Settings → Rotate API key). Before this release, Admins could also view the key.

##### Upgrade notes
- **Reverse proxies:** with `IP_HEADER=X-Forwarded-For`, the client IP is now the rightmost address that isn't in `IP_HEADER_TRUSTED_PROXIES` (it used to be the leftmost). If you have several proxies in a row, for example a CDN in front of nginx, add all of them to `IP_HEADER_TRUSTED_PROXIES`. Otherwise the address of the proxy in front is used for rate limiting and logs.
- **Sends:** `bw send receive` on CLI 2026.4.2 and older no longer works, the same as against Bitwarden's own servers since v2026.8.0. Creating and managing Sends works on all clients.
- **Feature flags:** these flags were removed because no client reads them anymore: `ssh-agent`, `ssh-key-vault-item`, `mutual-tls`, `anon-addy-self-host-alias`, `simple-login-self-host-alias`, `pm-25373-windows-biometrics-v2`, `pm-26340-linux-biometrics-v2`, `desktop-ui-migration-milestone-1` to `-4`, `cxp-import-mobile` and `cxp-export-mobile`. If `EXPERIMENTAL_CLIENT_FEATURE_FLAGS` still lists one of them, startup logs a warning and saving settings in the admin panel fails until it's removed.
- **Duo:** `DUO_USE_IFRAME` (the deprecated Traditional Prompt) is removed and ignored if set.
- **Custom templates:** there's a new email template, `email/recover_twofactor`, sent after a login with a two-step recovery code.
- The legacy `POST /identity/accounts/register` and `POST /api/accounts/prelogin` endpoints are removed. No current client uses them.
- When using a MariaDB or MySQL server which does not support native TLS/SSL encrypted connections, using the Alpine image of Vaultwarden might fail to connect. Add `MARIADB_TLS_DISABLE_PEER_VERIFICATION=1` as an environment variable to your Vaultwarden server environment, and it will start running again.

##### What's Changed
* [Web 2026.9.0] Support the vault banner policy by @tom27052006 in https://github.com/dani-garcia/vaultwarden/pull/7748
* Add support for basic auth response client feature flag by @tom27052006 in https://github.com/dani-garcia/vaultwarden/pull/7745
* [web-v2026.8.1] store the user key ID by @Timshel in https://github.com/dani-garcia/vaultwarden/pull/7693
* Add organizationsNew and policiesNew to sync response by @tom27052006 in https://github.com/dani-garcia/vaultwarden/pull/7666
* Add `pm-32009-new-item-types` feature flag by @bdd in https://github.com/dani-garcia/vaultwarden/pull/7478
* Update Crates, GHA and JS by @BlackDex in https://github.com/d

_[Truncated at 4000 characters — full notes: https://github.com/dani-garcia/vaultwarden/releases/tag/1.37.4]_

### 1.37.3

- Date: 2026-09-13
- Version: 1.37.3
- Original notes: https://github.com/dani-garcia/vaultwarden/releases/tag/1.37.3
- Permalink: https://whatsnew.fyi/product/vaultwarden/releases/1.37.3

- **fixed** — Fix password change with newer web-vault
- **fixed** — Ignore reset-password auto-enroll when mail is disabled
- **fixed** — Fix migration for MariaDB 12.2.2
- **added** — Add SSO_SIGNUPS_ALLOWED configuration option
- **fixed** — Fix organization import failing with missing field groups
- **added** — Add pm-32413-multi-client-password-management feature flag
- **changed** — Log IP and username on two-factor email-login credential failures
- **added** — Support admin reset of two-factor authentication
- **security** — Revoke 2FA remember tokens when credentials or 2FA change
- **security** — Rate limit prelogin and auth request endpoints
- **fixed** — Correct invalid comment syntax in .dockerignore
- **changed** — Route service clients through shared HTTP setup
- **fixed** — Fix iOS registration token response
- **fixed** — Fix archiveDate update

##### What's Changed
* Fix password change with newer web-vault by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/7634
* chore: remove duplicate "the" in ciphers.rs comment by @mvanhorn in https://github.com/dani-garcia/vaultwarden/pull/7254
* Ignore reset-password auto-enroll when mail is disabled by @xhon-pelushi in https://github.com/dani-garcia/vaultwarden/pull/7585
* Fix migration for MariaDB 12.2.2 by @Timshel in https://github.com/dani-garcia/vaultwarden/pull/7265
* Add SSO_SIGNUPS_ALLOWED by @Timshel in https://github.com/dani-garcia/vaultwarden/pull/7272
* log_event take enum parameter not i32 by @Timshel in https://github.com/dani-garcia/vaultwarden/pull/7656
* Misc Updates by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/7676
* Update rust docker version by @dani-garcia in https://github.com/dani-garcia/vaultwarden/pull/7689
* Fix organization import failing with missing field groups by @tom27052006 in https://github.com/dani-garcia/vaultwarden/pull/7699
* Add `pm-32413-multi-client-password-management` feature flag by @tom27052006 in https://github.com/dani-garcia/vaultwarden/pull/7677
* Log IP/username on two-factor email-login credential failures by @crahn in https://github.com/dani-garcia/vaultwarden/pull/7654
* Support admin reset 2fa by @Timshel in https://github.com/dani-garcia/vaultwarden/pull/7435
* fix(security): revoke 2FA remember tokens when credentials or 2FA change by @BryanFRD in https://github.com/dani-garcia/vaultwarden/pull/7682
* fix(security): rate limit prelogin and auth request endpoints by @BryanFRD in https://github.com/dani-garcia/vaultwarden/pull/7681
* fix: Correct invalid comment syntax in .dockerignore by @niniconi in https://github.com/dani-garcia/vaultwarden/pull/7274
* Update Rust and adjust DockerSettings by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/7690
* Route service clients through shared HTTP setup by @txase in https://github.com/dani-garcia/vaultwarden/pull/7639
* Fix iOS registration token response by @tom27052006 in https://github.com/dani-garcia/vaultwarden/pull/7714
* Use insert_into when possible by @Timshel in https://github.com/dani-garcia/vaultwarden/pull/6437
* Fix archiveDate update by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/7722

##### New Contributors
* @mvanhorn made their first contribution in https://github.com/dani-garcia/vaultwarden/pull/7254
* @xhon-pelushi made their first contribution in https://github.com/dani-garcia/vaultwarden/pull/7585
* @crahn made their first contribution in https://github.com/dani-garcia/vaultwarden/pull/7654
* @BryanFRD made their first contribution in https://github.com/dani-garcia/vaultwarden/pull/7682
* @niniconi made their first contribution in https://github.com/dani-garcia/vaultwarden/pull/7274

**Full Changelog**: https://github.com/dani-garcia/vaultwarden/compare/1.37.2...1.37.3

### 1.37.2

- Date: 2026-08-22
- Version: 1.37.2
- Original notes: https://github.com/dani-garcia/vaultwarden/releases/tag/1.37.2
- Permalink: https://whatsnew.fyi/product/vaultwarden/releases/1.37.2

- **fixed** — Fix Debian cross-linking with xx-cargo
- **fixed** — Fix playwright test
- **changed** — Misc fixes and updates
- **changed** — Include user email in successful login logs
- **fixed** — Fix sendmail executable permission check
- **added** — Add dummy revisionDate

##### Note

This update is required for support with clients with version 2026.8.0+, please update before reporting any issues with them.

> [!IMPORTANT]
> Also read #7615 for more details if you still have client issues!

##### What's Changed
* Fix Debian cross-linking with xx-cargo by @alexliluz in https://github.com/dani-garcia/vaultwarden/pull/7524
* Fix playwright test by @Timshel in https://github.com/dani-garcia/vaultwarden/pull/7548
* Misc fixes and updates by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/7558
* Include user email in successful login logs by @lmogthb in https://github.com/dani-garcia/vaultwarden/pull/7496
* Fix sendmail executable permission check by @p-boenisch in https://github.com/dani-garcia/vaultwarden/pull/7483
* add dummy revisionDate by @stefan0xC in https://github.com/dani-garcia/vaultwarden/pull/7608

##### New Contributors
* @alexliluz made their first contribution in https://github.com/dani-garcia/vaultwarden/pull/7524
* @lmogthb made their first contribution in https://github.com/dani-garcia/vaultwarden/pull/7496
* @p-boenisch made their first contribution in https://github.com/dani-garcia/vaultwarden/pull/7483

**Full Changelog**: https://github.com/dani-garcia/vaultwarden/compare/1.37.1...1.37.2

### 1.37.1

- Date: 2026-07-29
- Version: 1.37.1
- Original notes: https://github.com/dani-garcia/vaultwarden/releases/tag/1.37.1
- Permalink: https://whatsnew.fyi/product/vaultwarden/releases/1.37.1

- **fixed** — Resolve issues with invites by always sending initOrganization and orgUserHasExistingUser in invite URL
- **fixed** — Fix Alpine based image build issue with OpenSSL compilation by using newer rust-musl build images

##### Note

This patch release resolves the issues with invites.
If you have applied any workaround to fix this locally, please revert those fixes to prevent possible other issues.

I'm sorry that it took some time to check and validate this fix.

Also, this release fixes an issue (#7475) with all the Alpine based images which are build using https://github.com/BlackDex/rust-musl/.
An issue with the build image OpenSSL compilation is resolved and those are used to build the new `alpine` tagged containers.

##### What's Changed
* Always send initOrganization and orgUserHasExistingUser in invite URL by @vikfox in https://github.com/dani-garcia/vaultwarden/pull/7482
* Indirectly resolved #7475 by using newer rust-musl build images which had a compilation issue with OpenSSL.

##### New Contributors
* @vikfox made their first contribution in https://github.com/dani-garcia/vaultwarden/pull/7482

**Full Changelog**: https://github.com/dani-garcia/vaultwarden/compare/1.37.0...1.37.1

### 1.37.0

- Date: 2026-07-24
- Version: 1.37.0
- Original notes: https://github.com/dani-garcia/vaultwarden/releases/tag/1.37.0
- Permalink: https://whatsnew.fyi/product/vaultwarden/releases/1.37.0

- **security** — Fix SSRF via the icon endpoint
- **security** — Fix Cross-Organization Cipher Access
- **security** — Fix Organization Policy Bypass on Directory Import
- **security** — Fix Send Access-Count Bypass
- **security** — Fix Unauthenticated WebSocket Flooding DDOS
- **security** — Fix Cross-Organization Secret Sharing
- **security** — Fix Organization Import Authorization
- **security** — Fix Organization Data Enumeration via the Manager role
- **added** — Add OpenDAL S3 parameter support
- **added** — Serve Apple app site association file
- **added** — Add SSO_AUTHORIZE_BODY configuration option
- **added** — Add pm-26340-linux-biometrics-v2 feature flag
- **added** — Add trusted proxy support and unauthenticated rate limit
- **fixed** — Fix SSO Cookie path
- **fixed** — Fix email 2fa for bw cli
- **fixed** — Fix enforce blocked
- **fixed** — Fix hideEmail as non-null boolean in sync response
- **fixed** — Fix Custom Role CSS for new dialog markup
- **fixed** — Fix compilation with newer rust-musl version
- **changed** — Reject unrecognised DATABASE_URL instead of silent SQLite fallback
- **changed** — Switch to Rust Edition 2024

##### Note
This update is required for support with clients with version 2026.7.0+, please update before reporting any issues with them.

##### Security Fixes
This release contains security fixes for the following advisories. We strongly advice to update as soon as possible.
- SSRF via the icon endpoint [[GHSA-hw4g-2v3f-74x5]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-hw4g-2v3f-74x5) [[GHSA-vh5m-fc9v-m84g]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-vh5m-fc9v-m84g) (**Medium**, 5.8 / 6.3)
- Cross-Organization Cipher Access [[GHSA-xwf8-pjh7-h589]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-xwf8-pjh7-h589) (**Medium**, 5.9)
- Organization Policy Bypass on Directory Import [[GHSA-88qc-6ch9-mc3j]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-88qc-6ch9-mc3j) (**Medium**, 5.5)
- Send Access-Count Bypass [[GHSA-rxhg-2pw9-vf25]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-rxhg-2pw9-vf25) (**Medium**, 5.3)
- Unauthenticated WebSocket Flooding DDOS [[GHSA-96f7-78q5-j345]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-96f7-78q5-j345) (**Medium**, 5.3)
- Cross-Organization Secret Sharing [[GHSA-455c-vgg9-jxw8]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-455c-vgg9-jxw8) (**Medium**, 4.3)
- Organization Import Authorization [[GHSA-f3qw-qg77-hmm4]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-f3qw-qg77-hmm4)[[GHSA-jq2g-h4xr-4mcr]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-jq2g-h4xr-4mcr) (**Medium**, 4.3)
- Organization Data Enumeration via the Manager role [[GHSA-rqf8-2568-r7mc]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-rqf8-2568-r7mc) (**Medium**, 4.3)

These are private for now, pending CVE assignment and publishing at a later date.

##### What's Changed
* OpenDAL S3 parameter support by @txase in https://github.com/dani-garcia/vaultwarden/pull/6127
* Fix SSO Cookie path by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/7187
* fix email 2fa for bw cli by @stefan0xC in https://github.com/dani-garcia/vaultwarden/pull/7225
* sso_auth improvements by @Timshel in https://github.com/dani-garcia/vaultwarden/pull/7197
* Reject unrecognised DATABASE_URL instead of silent SQLite fallback by @mfw78 in https://github.com/dani-garcia/vaultwarden/pull/7061
* Switch to `xx-cargo` by @dfunkt in https://github.com/dani-garcia/vaultwarden/pull/6640
* Updates and fixes by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/7235
* Switch to Edition 2024, more clippy lints, and less macro calls by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/7200
* Serve Apple app site association file by @user71424q in https://github.com/dani-garcia/vaultwarden/pull/7191
* Update Rust, Crates and GHA by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/7307
* Fix enforce blocked by @Timshel in https://github.com/dani-garcia/vaultwarden/pull/7246
* Admin password recovery endpoint change by @Timshel in https://github.com/dani-garcia/vaultwarden/pull/7270
* fix(sends): emit hideEmail as non-null boolean in sync response by @kvdb in https://github.com/dani-garcia/vaultwarden/pull/7283
* Org membership delete remove Invitation by @Timshel in https://github.com/dani-garcia/vaultwarden/pull/7284
* [v2026.5.0] Registration request update by @Timshel in https://github.com/dani-garcia/vaultwarden/pull/7295
* [v2026.5.0] PutPolicy now using vnext format by @Timshel in https://github.com/dani-garcia/vaultwarden/pull/7296
* 2026.6.0 send support by @Timshel in https://github.com/dani-garcia/vaultwarden/pull/7346
* Add SSO_AUTHORIZE_BODY by @Timshel in https://github.com/dani-garcia/vaultwarden/pull/7357
* Add `pm-26340-linux-biometrics-v2` feature flag by @pilotstew in https://github.com/dani-garcia/vaultwarden/pull/7358
* improve CI by @TriplEight in https://g

_[Truncated at 4000 characters — full notes: https://github.com/dani-garcia/vaultwarden/releases/tag/1.37.0]_

### 1.36.0

- Date: 2026-05-03
- Version: 1.36.0
- Original notes: https://github.com/dani-garcia/vaultwarden/releases/tag/1.36.0
- Permalink: https://whatsnew.fyi/product/vaultwarden/releases/1.36.0

- **security** — Fix SSO login CSRF vulnerability
- **security** — Fix user and organization enumeration vulnerability
- **security** — Fix SSO existing-user binding vulnerability
- **security** — Fix SSRF vulnerability via icon endpoint
- **security** — Update crates and apply minor security enhancements
- **added** — Add support for archiving items
- **added** — Add new /identity/accounts/prelogin/password endpoint
- **added** — Add DuckDuckGo browser device type
- **changed** — Update web vault to v2026.4.1
- **changed** — SSO fallback to UserInfo preferred_username
- **fixed** — Fix hardcoded SSO identifier
- **fixed** — Fix host and IP resolving
- **fixed** — Fix favicon fetching to check all icon links instead of just the first one
- **fixed** — Replace organization_uuid unwrap with proper error handling
- **fixed** — Return error instead of panic on unknown cipher atype in to_json
- **changed** — Allow SQLite to be linked against dynamically
- **changed** — Update hickory dependency

##### Security Fixes
This release contains security fixes for the following advisories. We strongly advice to update as soon as possible.
- SSO Login CSRF
  [GHSA-pfp2-jhgq-6hg5](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-pfp2-jhgq-6hg5)
  [GHSA-w6h6-8r66-hcv7](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-w6h6-8r66-hcv7)
- User/Organization Enumeration
  [GHSA-hxqh-ff5p-wfr3](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-hxqh-ff5p-wfr3)
- SSO existing-user binding
  [GHSA-j4j8-gpvj-7fqr](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-j4j8-gpvj-7fqr)
  [GHSA-6x5c-84vm-5j56](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-6x5c-84vm-5j56)
- SSRF via Icon Endpoint
  [GHSA-72vh-x5jq-m82g](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-72vh-x5jq-m82g)
- Some crate's updated and other minor security enhancements

These are private for now, pending CVE assignment.


##### Notes
- Archiving of items is available
  https://bitwarden.com/blog/keep-your-vault-tidy-with-item-archiving/
  https://bitwarden.com/nl-nl/help/managing-items/#archive
- Web Vault updated to v2026.4.1


##### What's Changed
* SSO fallback to UserInfo preferred_username by @Timshel in https://github.com/dani-garcia/vaultwarden/pull/7128
* Dummy identifier need to pass for a guid by @Timshel in https://github.com/dani-garcia/vaultwarden/pull/7154
* add new /identity/accounts/prelogin/password by @stefan0xC in https://github.com/dani-garcia/vaultwarden/pull/7156
* Add DuckDuckGo browser device type by @dfunkt in https://github.com/dani-garcia/vaultwarden/pull/7147
* Apply `duration_suboptimal_units` lint findings by @dfunkt in https://github.com/dani-garcia/vaultwarden/pull/7144
* Apply `ref_option` lint findings by @dfunkt in https://github.com/dani-garcia/vaultwarden/pull/7143
* Fix hardcoded sso identifier by @Timshel in https://github.com/dani-garcia/vaultwarden/pull/7157
* Update crates and fix a nightly lint by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/7161
* Fix Host/IP resolving by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/7162
* Several SSO Fixes by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/7163
* Add support for archiving items by @matt-aaron in https://github.com/dani-garcia/vaultwarden/pull/6916
* Fix favicon fetching to check all icon links instead of just the first one by @Shocker in https://github.com/dani-garcia/vaultwarden/pull/6880
* Fix merge conflict by @dani-garcia in https://github.com/dani-garcia/vaultwarden/pull/7164
* Replace organization_uuid unwrap with proper error handling by @xjohnyknox in https://github.com/dani-garcia/vaultwarden/pull/6936
* fix: return Err instead of panic on unknown cipher atype in to_json() by @mango766 in https://github.com/dani-garcia/vaultwarden/pull/7068
* Allow SQLite to be linked against dynamically by @ISSOtm in https://github.com/dani-garcia/vaultwarden/pull/7057
* Update crates and web-vault by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/7171
* Update hickory by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/7175

##### New Contributors
* @matt-aaron made their first contribution in https://github.com/dani-garcia/vaultwarden/pull/6916
* @Shocker made their first contribution in https://github.com/dani-garcia/vaultwarden/pull/6880
* @xjohnyknox made their first contribution in https://github.com/dani-garcia/vaultwarden/pull/6936
* @mango766 made their first contribution in https://github.com/dani-garcia/vaultwarden/pull/7068
* @ISSOtm made their first contribution in https://github.com/dani-garcia/vaultwarden/pull/7057


**Full Changelog**: https://github.com/dani-garcia/vaultwarden/compare/1.35.8...1.36.0

You can discuss this release here https://github.com/dani-garcia/vaultwarden/discussions/7177

### 1.35.8

- Date: 2026-04-25
- Version: 1.35.8
- Original notes: https://github.com/dani-garcia/vaultwarden/releases/tag/1.35.8
- Permalink: https://whatsnew.fyi/product/vaultwarden/releases/1.35.8

- **fixed** — Fix dummy org Master password policy authentication
- **fixed** — Fix recovery-code not working
- **fixed** — Fix invalid refresh token response
- **changed** — Update Rust, Crates, and GHA
- **fixed** — Fix a DNS issue
- **changed** — Update web-vault and crates

##### What's Changed
* Dummy org Master password policy auth fix by @Timshel in https://github.com/dani-garcia/vaultwarden/pull/7097
* Fix recovery-code not working by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/7102
* Fix invalid refresh token response by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/7105
* Update Rust, Crates, GHA and fix a DNS issue by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/7108
* Update web-vault and crates by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/7121


**Full Changelog**: https://github.com/dani-garcia/vaultwarden/compare/1.35.7...1.35.8

### 1.35.7

- Date: 2026-04-13
- Version: 1.35.7
- Original notes: https://github.com/dani-garcia/vaultwarden/releases/tag/1.35.7
- Permalink: https://whatsnew.fyi/product/vaultwarden/releases/1.35.7

- **fixed** — Fix 2FA for Android

##### What's Changed
* Fix 2FA for Android by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/7093


**Full Changelog**: https://github.com/dani-garcia/vaultwarden/compare/1.35.6...1.35.7

### 1.35.6

- Date: 2026-04-12
- Version: 1.35.6
- Original notes: https://github.com/dani-garcia/vaultwarden/releases/tag/1.35.6
- Permalink: https://whatsnew.fyi/product/vaultwarden/releases/1.35.6

- **fixed** — Two Factor Remember Tokens and Recovery Tokens are now accepted

##### Notes
The previous release contained an issue where Two Factor Remember Tokens and Recovery Tokens were not accepted at all.
This has been fixed now in this release.


##### What's Changed
* Fix MFA Remember by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/7085


**Full Changelog**: https://github.com/dani-garcia/vaultwarden/compare/1.35.5...1.35.6

### 1.35.5

- Date: 2026-04-12
- Version: 1.35.5
- Original notes: https://github.com/dani-garcia/vaultwarden/releases/tag/1.35.5
- Permalink: https://whatsnew.fyi/product/vaultwarden/releases/1.35.5

- **security** — Fix unconfirmed owner ability to purge entire organization vault
- **security** — Fix cross-org group binding that enabled unauthorized read and write access into another organization
- **security** — Invalidate refresh tokens on security stamp rotation
- **fixed** — Apply policies only to confirmed members
- **added** — Add feature flag for Safari account switching
- **fixed** — Add ForcePasswordReset to API key login
- **added** — Add Webauthn related origins flag to known flags
- **added** — Add 30-second cache to SSO exchange_refresh_token
- **added** — Add cxp-import-mobile and cxp-export-mobile feature flags on mobile
- **changed** — Support new desktop origin on CORS
- **fixed** — Fix API key login
- **fixed** — Fix email header base64 padding
- **changed** — Two Factor Remember Tokens are now valid for maximum 30 days
- **fixed** — Fix empty string FolderId
- **fixed** — Fix Send icons
- **fixed** — Prevent managers from creating collections
- **changed** — Change SQLite backup to use VACUUM INTO query
- **added** — Handle SIGTERM and SIGQUIT shutdown signals
- **fixed** — Do not display unavailable 2FA options
- **fixed** — Fix logout push identifiers and send logout before clearing devices

##### Security Fixes
This release contains security fixes for the following advisories. We strongly advice to update as soon as possible.
- [GHSA-937x-3j8m-7w7p](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-937x-3j8m-7w7p) Unconfirmed Owner Can Purge Entire Organization Vault.
- [GHSA-569v-845w-g82p](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-569v-845w-g82p) Cross-Org Group Binding Enables Unauthorized Read And Write Access Into Another Organization
- [GHSA-6j4w-g4jh-xjfx](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-6j4w-g4jh-xjfx) Refresh tokens not invalidated on security stamp rotation

These are private for now, pending CVE assignment.

##### Notes
- The admin templates have changed, please update them if you override these via templates.
- Two Factor Remember Tokens are now valid for max 30 days. Old tokens are invalid directly after upgrading.

##### What's Changed
* apply policies only to confirmed members by @stefan0xC in https://github.com/dani-garcia/vaultwarden/pull/6892
* Feat(config): add feature flag for Safari account switching by @DerPlayer2001 in https://github.com/dani-garcia/vaultwarden/pull/6891
* fix: add ForcePasswordReset to api key login by @montdidier in https://github.com/dani-garcia/vaultwarden/pull/6904
* Add Webauthn related origins flag to known flags. by @pasarenicu in https://github.com/dani-garcia/vaultwarden/pull/6900
* Add 30s cache to SSO exchange_refresh_token by @Timshel in https://github.com/dani-garcia/vaultwarden/pull/6866
* Add cxp-import-mobile and cxp-export-mobile: feature flags on mobile by @phoeagon in https://github.com/dani-garcia/vaultwarden/pull/6853
* Misc updates and fixes by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/6910
* Support new desktop origin on CORS by @dani-garcia in https://github.com/dani-garcia/vaultwarden/pull/6920
* Fix `checkout` action version by @dfunkt in https://github.com/dani-garcia/vaultwarden/pull/6921
* Fix apikey login by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/6922
* Fix email header base64 padding by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/6961
* Update Feature Flags by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/6981
* Update crates and GHA by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/6980
* Use protected CI environment by @dani-garcia in https://github.com/dani-garcia/vaultwarden/pull/7004
* Fix 2FA Remember to actually be 30 days by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/6929
* Misc Updates by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/7027
* Switch to `attest` action by @dfunkt in https://github.com/dani-garcia/vaultwarden/pull/7017
* Rotate refresh-tokens on sstamp reset by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/7031
* Misc org fixes by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/7032
* Fix empty string FolderId by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/7048
* Disable deployments for release env by @dfunkt in https://github.com/dani-garcia/vaultwarden/pull/7033
* Fix Send icons by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/7051
* prevent managers from creating collections by @stefan0xC in https://github.com/dani-garcia/vaultwarden/pull/6890
* Change SQLite backup to use VACUUM INTO query by @getaaron in https://github.com/dani-garcia/vaultwarden/pull/6989
* Handle `SIGTERM` and `SIGQUIT` shutdown signals. by @0x484558 in https://github.com/dani-garcia/vaultwarden/pull/7008
* Do not display unavailable 2FA options by @0x484558 in https://github.com/dani-garcia/vaultwarden/pull/7013
* Fix logout push identifiers and send logout before clearing devices by @qaz741wsd856 in https://github.com/dani-garcia/vaultwarden/pull/7047
* Fix windows build issues by @idontneedonetho in https://github.com/dani-garcia/vaultwarden/pull/706

_[Truncated at 4000 characters — full notes: https://github.com/dani-garcia/vaultwarden/releases/tag/1.35.5]_

### 1.35.4

- Date: 2026-02-23
- Version: 1.35.4
- Original notes: https://github.com/dani-garcia/vaultwarden/releases/tag/1.35.4
- Permalink: https://whatsnew.fyi/product/vaultwarden/releases/1.35.4

- **security** — Fix vulnerability allowing an attacker to access a cipher from a different user if they know its internal UUID
- **security** — Fix vulnerability allowing an attacker with manager-level access within an organization to modify collections they can access without management permissions
- **security** — Fix vulnerability allowing an attacker with manager-level access within an organization to modify collections they are not assigned
- **changed** — Hide remember 2FA token
- **fixed** — Fix invite links in send invitations
- **changed** — Miscellaneous organization fixes

##### Security Fixes
This release contains security fixes for the following advisories. We strongly advice to update as soon as possible.
- [GHSA-w9f8-m526-h7fh](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-w9f8-m526-h7fh). This vulnerability would allow an attacker to access a cipher from a different user (fully encrypted) if they already know its internal UUID.
- [GHSA-h4hq-rgvh-wh27](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-h4hq-rgvh-wh27). This vulnerability allows an attacker with manager-level access within an organization to modify collections they can access, even if they do not have management permissions for them.
- [GHSA-r32r-j5jq-3w4m](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-r32r-j5jq-3w4m). This vulnerability allows an attacker with manager-level access within an organization to modify collections they are not assigned.

These are private for now, pending CVE assignment.

##### What's Changed
* Update Rust and Crates and GHA by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/6843
* hide remember 2fa token by @stefan0xC in https://github.com/dani-garcia/vaultwarden/pull/6852
* fix(send_invite): invite links by @proofofcopilot in https://github.com/dani-garcia/vaultwarden/pull/6824
* Misc organization fixes by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/6867

##### New Contributors
* @proofofcopilot made their first contribution in https://github.com/dani-garcia/vaultwarden/pull/6824

**Full Changelog**: https://github.com/dani-garcia/vaultwarden/compare/1.35.3...1.35.4

### 1.35.3

- Date: 2026-02-10
- Version: 1.35.3
- Original notes: https://github.com/dani-garcia/vaultwarden/releases/tag/1.35.3
- Permalink: https://whatsnew.fyi/product/vaultwarden/releases/1.35.3

- **security** — Fix vulnerability allowing authenticated attackers in an organization to access items from collections they do not belong to (GHSA-h265-g7rm-h337)
- **fixed** — Fix User API Key login
- **fixed** — Use email instead of empty name for WebAuthn
- **fixed** — Hide password hints via CSS
- **fixed** — Fix email as 2FA with auth requests
- **fixed** — Empty AccountKeys when no private key
- **fixed** — Fix error message for purging auth requests
- **fixed** — Fix org-details issue
- **changed** — Improve tooltips in diagnostics page
- **changed** — Update crates, web-vault, and JavaScript dependencies

##### Security Fixes

This release contains security fixes for the following advisory. We strongly advice to update as soon as possible if you believe it could affect you.
- [GHSA-h265-g7rm-h337](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-h265-g7rm-h337) (Publication in process, waiting for CVE assignment)
  This vulnerability would allow an authenticated attacker that is part of an organization to access items from collections to which the attacker does not belong.

##### What's Changed
* Fix User API Key login by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/6712
* use email instead of empty name for webauhn by @stefan0xC in https://github.com/dani-garcia/vaultwarden/pull/6733
* hide password hints via CSS by @stefan0xC in https://github.com/dani-garcia/vaultwarden/pull/6726
* fix email as 2fa with auth requests by @stefan0xC in https://github.com/dani-garcia/vaultwarden/pull/6736
* Update crates, web-vault, js, workflows by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/6749
* refactor: improve tooltips in diagnostics page by @tessus in https://github.com/dani-garcia/vaultwarden/pull/6765
* Empty AccountKeys when no private key by @Timshel in https://github.com/dani-garcia/vaultwarden/pull/6761
* fix error message for purging auth requests by @stefan0xC in https://github.com/dani-garcia/vaultwarden/pull/6776
* Misc updates, crates, rust, js, gha, vault by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/6799
* Update crates and web-vault by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/6810
* Fix org-details issue by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/6811


**Full Changelog**: https://github.com/dani-garcia/vaultwarden/compare/1.35.2...1.35.3

### 1.35.2

- Date: 2026-01-09
- Version: 1.35.2
- Original notes: https://github.com/dani-garcia/vaultwarden/releases/tag/1.35.2
- Permalink: https://whatsnew.fyi/product/vaultwarden/releases/1.35.2

- **fixed** — Fix an issue with the web-vault which prevented creating an organization
- **fixed** — Return no content with status code 204
- **changed** — Allow MasterPasswordHash for Android
- **changed** — Improve SSO callback path
- **fixed** — Fix web-vault version check and update web-vault

##### Notable changes

Fixed an issue with the web-vault which prevent creating an organization.

##### What's Changed
* update web-vault to fix org creation by @stefan0xC in https://github.com/dani-garcia/vaultwarden/pull/6646
* return no content with status code 204 by @stefan0xC in https://github.com/dani-garcia/vaultwarden/pull/6665
* allow MasterPasswordHash for Android by @stefan0xC in https://github.com/dani-garcia/vaultwarden/pull/6673
* improve sso callback path by @stefan0xC in https://github.com/dani-garcia/vaultwarden/pull/6676
* Fix web-vault version check and update web-vault by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/6686


**Full Changelog**: https://github.com/dani-garcia/vaultwarden/compare/1.35.1...1.35.2