Security Fixes This release contains security fixes for the following advisories. We strongly advise updating as soon as possible. Website icons [GHSA-x9cq-f669-vrr4] (Medium, 5.3) Emergency access [GHSA-9pjj-f9g5-3x4c] (Medium, 4.3) These are private for now, pending CVE assignment and publishing at a later date. Note This update is required for web vault 2026.7.1+ to turn two-step login methods…
Security Fixes This release contains security fixes for the following advisories. We strongly advise updating as soon as possible. Organization member revocation [GHSA-69q9-v8p6-xvx3] (High, 8.1) Two-factor authentication [GHSA-7jg8-8m5x-6j9r] (Medium, 6.8) Organization invitations [GHSA-v576-3wvq-xh3c] (Medium, 6.8) Attachments [GHSA-q5x6-grh5-fqgc] (Medium, 6.5) Organization event logs [GHSA-64m…
What's Changed Fix password change with newer web-vault by @BlackDex in #7634 chore: remove duplicate "the" in ciphers.rs comment by @mvanhorn in #7254 Ignore reset-password auto-enroll when mail is disabled by @xhon-pelushi in #7585 Fix migration for MariaDB 12.2.2 by @Timshel in #7265 Add SSO_SIGNUPS_ALLOWED by @Timshel in #7272 log_event take enum parameter not i32 by @Timshel in #7656 Misc Upd…
Note This update is required for support with clients with version 2026.8.0+, please update before reporting any issues with them. ImportantAlso read #7615 for more details if you still have client issues! What's Changed Fix Debian cross-linking with xx-cargo by @alexliluz in #7524 Fix playwright test by @Timshel in #7548 Misc fixes and updates by @BlackDex in #7558 Include user email in successfu…
Note This patch release resolves the issues with invites. If you have applied any workaround to fix this locally, please revert those fixes to prevent possible other issues. I'm sorry that it took some time to check and validate this fix. Also, this release fixes an issue (#7475) with all the Alpine based images which are build using https://github.com/BlackDex/rust-musl/. An issue with the build…
Note This update is required for support with clients with version 2026.7.0+, please update before reporting any issues with them. Security Fixes This release contains security fixes for the following advisories. We strongly advice to update as soon as possible. SSRF via the icon endpoint [GHSA-hw4g-2v3f-74x5] [GHSA-vh5m-fc9v-m84g] (Medium, 5.8 / 6.3) Cross-Organization Cipher Access [GHSA-xwf8-pj…
Security Fixes This release contains security fixes for the following advisories. We strongly advice to update as soon as possible. SSO Login CSRF GHSA-pfp2-jhgq-6hg5 GHSA-w6h6-8r66-hcv7 User/Organization Enumeration GHSA-hxqh-ff5p-wfr3 SSO existing-user binding GHSA-j4j8-gpvj-7fqr GHSA-6x5c-84vm-5j56 SSRF via Icon Endpoint GHSA-72vh-x5jq-m82g Some crate's updated and other minor security enhancem…
What's Changed Dummy org Master password policy auth fix by @Timshel in #7097 Fix recovery-code not working by @BlackDex in #7102 Fix invalid refresh token response by @BlackDex in #7105 Update Rust, Crates, GHA and fix a DNS issue by @BlackDex in #7108 Update web-vault and crates by @BlackDex in #7121 Full Changelog: 1.35.7...1.35.8
What's Changed Fix 2FA for Android by @BlackDex in #7093 Full Changelog: 1.35.6...1.35.7
Notes The previous release contained an issue where Two Factor Remember Tokens and Recovery Tokens were not accepted at all. This has been fixed now in this release. What's Changed Fix MFA Remember by @BlackDex in #7085 Full Changelog: 1.35.5...1.35.6
Security Fixes This release contains security fixes for the following advisories. We strongly advice to update as soon as possible. GHSA-937x-3j8m-7w7p Unconfirmed Owner Can Purge Entire Organization Vault. GHSA-569v-845w-g82p Cross-Org Group Binding Enables Unauthorized Read And Write Access Into Another Organization GHSA-6j4w-g4jh-xjfx Refresh tokens not invalidated on security stamp rotation Th…
Security Fixes This release contains security fixes for the following advisories. We strongly advice to update as soon as possible. GHSA-w9f8-m526-h7fh. This vulnerability would allow an attacker to access a cipher from a different user (fully encrypted) if they already know its internal UUID. GHSA-h4hq-rgvh-wh27. This vulnerability allows an attacker with manager-level access within an organizati…
Security Fixes This release contains security fixes for the following advisory. We strongly advice to update as soon as possible if you believe it could affect you. GHSA-h265-g7rm-h337 (Publication in process, waiting for CVE assignment) This vulnerability would allow an authenticated attacker that is part of an organization to access items from collections to which the attacker does not belong. W…
Notable changes Fixed an issue with the web-vault which prevent creating an organization. What's Changed update web-vault to fix org creation by @stefan0xC in #6646 return no content with status code 204 by @stefan0xC in #6665 allow MasterPasswordHash for Android by @stefan0xC in #6673 improve sso callback path by @stefan0xC in #6676 Fix web-vault version check and update web-vault by @BlackDex in…
Notable changes Fixed issue with applications being logged out after upgrading due to changes to refresh token parsing Updated web vault to 2025.12.1 Correctly publish alpine tag, which was missing in 1.35.0 What's Changed Update lockfile by @dani-garcia in #6600 Re-add alpine tag by @dfunkt in #6626 Misc updates by @BlackDex in #6627 Try old refresh token if we fail to decode jwt by @dani-garcia…
Notable changes Implemented support for SSO with OpenID Connect, https://github.com/dani-garcia/vaultwarden/wiki/Enabling-SSO-support-using-OpenId-Connect Updated web vault to 2025.12.0 Added support for future mobile apps with versions 2026.1.0+ This is the first vaultwarden release using immutable releases and release attestation! What's Changed Fix multi delete slowdown by @BlackDex in #6144 Pe…