Skip to content

Release history

vaultwarden releases

Unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs

Back to tool Latest release

All releases

9 shown

Upgrade now
1.37.0 Breaking risk
Auth RBAC RCE / SSRF

Security fixes

Open
1.36.0 Security relevant
Security fixes
  • SSO Login CSRF — GHSA-pfp2-jhgq-6hg5, GHSA-w6h6-8r66-hcv7
  • User/Organization Enumeration — GHSA-hxqh-ff5p-wfr3
  • SSO existing-user binding — GHSA-j4j8-gpvj-7fqr, GHSA-6x5c-84vm-5j56
Notable features
  • Archiving of items is now available
  • Web Vault updated to v2026.4.1
  • Add DuckDuckGo browser device type
Full changelog

Security Fixes

This release contains security fixes for the following advisories. We strongly advice to update as soon as possible.

These are private for now, pending CVE assignment.

Notes

  • Archiving of items is available
    https://bitwarden.com/blog/keep-your-vault-tidy-with-item-archiving/
    https://bitwarden.com/nl-nl/help/managing-items/#archive
  • Web Vault updated to v2026.4.1

What's Changed

  • SSO fallback to UserInfo preferred_username by @Timshel in https://github.com/dani-garcia/vaultwarden/pull/7128
  • Dummy identifier need to pass for a guid by @Timshel in https://github.com/dani-garcia/vaultwarden/pull/7154
  • add new /identity/accounts/prelogin/password by @stefan0xC in https://github.com/dani-garcia/vaultwarden/pull/7156
  • Add DuckDuckGo browser device type by @dfunkt in https://github.com/dani-garcia/vaultwarden/pull/7147
  • Apply duration_suboptimal_units lint findings by @dfunkt in https://github.com/dani-garcia/vaultwarden/pull/7144
  • Apply ref_option lint findings by @dfunkt in https://github.com/dani-garcia/vaultwarden/pull/7143
  • Fix hardcoded sso identifier by @Timshel in https://github.com/dani-garcia/vaultwarden/pull/7157
  • Update crates and fix a nightly lint by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/7161
  • Fix Host/IP resolving by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/7162
  • Several SSO Fixes by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/7163
  • Add support for archiving items by @matt-aaron in https://github.com/dani-garcia/vaultwarden/pull/6916
  • Fix favicon fetching to check all icon links instead of just the first one by @Shocker in https://github.com/dani-garcia/vaultwarden/pull/6880
  • Fix merge conflict by @dani-garcia in https://github.com/dani-garcia/vaultwarden/pull/7164
  • Replace organization_uuid unwrap with proper error handling by @xjohnyknox in https://github.com/dani-garcia/vaultwarden/pull/6936
  • fix: return Err instead of panic on unknown cipher atype in to_json() by @mango766 in https://github.com/dani-garcia/vaultwarden/pull/7068
  • Allow SQLite to be linked against dynamically by @ISSOtm in https://github.com/dani-garcia/vaultwarden/pull/7057
  • Update crates and web-vault by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/7171
  • Update hickory by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/7175

New Contributors

  • @matt-aaron made their first contribution in https://github.com/dani-garcia/vaultwarden/pull/6916
  • @Shocker made their first contribution in https://github.com/dani-garcia/vaultwarden/pull/6880
  • @xjohnyknox made their first contribution in https://github.com/dani-garcia/vaultwarden/pull/6936
  • @mango766 made their first contribution in https://github.com/dani-garcia/vaultwarden/pull/7068
  • @ISSOtm made their first contribution in https://github.com/dani-garcia/vaultwarden/pull/7057

Full Changelog: https://github.com/dani-garcia/vaultwarden/compare/1.35.8...1.36.0

You can discuss this release here https://github.com/dani-garcia/vaultwarden/discussions/7177

View release on GitHub
1.35.8 Bug fix

Minor fixes and improvements.

Full changelog

What's Changed

  • Dummy org Master password policy auth fix by @Timshel in https://github.com/dani-garcia/vaultwarden/pull/7097
  • Fix recovery-code not working by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/7102
  • Fix invalid refresh token response by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/7105
  • Update Rust, Crates, GHA and fix a DNS issue by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/7108
  • Update web-vault and crates by @BlackDex in https://github.com/dani-garcia/vaultwarden/pull/7121

Full Changelog: https://github.com/dani-garcia/vaultwarden/compare/1.35.7...1.35.8

View release on GitHub
1.35.6 Bug fix

Restores Two Factor Authentication Remember and Recovery Token functionality.

View release on GitHub
1.35.5 Breaking risk
Breaking changes
  • Admin templates have changed; manual updates required if customized
Security fixes
  • GHSA-937x-3j8m-7w7p: Unconfirmed Owner Can Purge Entire Organization Vault
  • GHSA-569v-845w-g82p: Cross-Org Group Binding Enables Unauthorized Read And Write Access Into Another Organization
  • GHSA-6j4w-g4jh-xjfx: Refresh tokens not invalidated on security stamp rotation
Notable features
  • Safari account switching feature flag
  • 30-second cache for SSO token exchange
  • SIGTERM and SIGQUIT signal handling
View release on GitHub
1.35.4 Security relevant
Security fixes
  • GHSA-w9f8-m526-h7fh: Cipher access vulnerability via UUID
  • GHSA-h4hq-rgvh-wh27: Manager collection modification vulnerability
  • GHSA-r32r-j5jq-3w4m: Manager collection access vulnerability
View release on GitHub
1.35.3 Security relevant
Security fixes
  • GHSA-h265-g7rm-h337: Collection access bypass for organization members
View release on GitHub
1.35.2 Bug fix
Notable features
  • MasterPasswordHash support for Android
  • Improved SSO callback path
View release on GitHub

Beta — feedback welcome: [email protected]