VaultWarden

Release 1.36.0 mitigates multiple security advisories (SSO CSRF/enumeration, SSO binding, SSRF), adds item archiving and a new prelogin password endpoint, and updates crates plus Web Vault to 2026.4.1.

Vaultwarden 1.35.8 includes fixes for master password policy auth, recovery codes, and invalid refresh tokens, plus updates to Rust/crates/CI and DNS, plus web-vault and crates updates.

Vaultwarden 1.35.7 fixes Android 2FA support (contributed by @BlackDex).

Fixes for MFA Remember and Recovery Tokens not being accepted; restores support for Two Factor Remember Tokens, includes MFA Remember fix by BlackDex.

This release patches three security advisories, updates admin templates, enforces 2FA remember tokens to 30 days, and adds numerous feature flags and fixes (Safari switch, WebAuthn origins, SSO cache, API login fixes, etc.).

Security fixes address three advisories (data access, manager-level collection modification) and the release includes Rust/crates updates, hidden 2FA token, invite link fixes, organization tweaks, plus a new contributor (proofofcopilot).

Security fixes include GHSA-h265-g7rm-h337; user API key login fix; webauthn email; hide password hints; 2FA with auth requests; crates/web-vault updates; diagnostics tooltips; empty AccountKeys; purge error message; misc updates.

Fixes include web-vault org creation, 204 No Content response, Android MasterPasswordHash support; improved SSO callback; and web-vault version check/update.

Fix logout issue after upgrade by adjusting refresh token parsing, update web vault to 2025.12.1, restore alpine tag in 1.35.1, update lockfile, apply misc changes, and retry old refresh token if JWT decode fails.

Adds OpenID Connect SSO support, updates web vault to 2025.12.0, enables mobile app compatibility for 2026.1.0+, and marks Vaultwarden's first immutable release with release attestation.

Fix MySQL/MariaDB connection issue on Alpine by restoring MariaDB Connector/C v3.4.5; crates update triggers rebuild and signup link hiding fix.

Vaultwarden 1.35.0: web vault updated to 2025.7.0 with experimental S3/OpenDAL backend (s3 feature); plus UI, policy, admin, and compatibility fixes.

Fixes an admin diagnostics crash (contributed by @BlackDex) in the 1.34.0→1.34.1 update.

Vaultwarden 1.34.0 updates web-vault to 2025.5.0, adds a new email-verified registration flow, and introduces feature flags for mutual TLS, attachment export, and AnonAddy/SimpleLogin self-host, plus Rust upgrades and assorted fixes.

Security and dependency updates, including CVE-2025-24898 fix; new bulk-access endpoint for collections; desktop icon redirect fix; and showing assigned collections on member edit.

Fixes for desktop icons, invites, Duo fields, manager rights, and mobile sync; adds OrgMemberHeaders access for invited members, new event types, passwordRevisionDate fix, broader collection creation rights for managers, and Rust 1.84.1 update (new contributors welcome).

This release patches three security advisories, updates web-vault to 2025.1.1, adds partial manager role for collections, introduces artifact attestations for OCI/images, and includes multiple feature updates and fixes.

Security fix for CVE affecting ORG_GROUPS_ENABLED; release also masks smtp_img_src, includes refactoring and security fixes, enables adding connect-src entries, and updates fern.

Release fixes push, member access edits, and native sync issues; updates Rust crates and Alpine 3.21; backend admin tweaks; new contributor chuangjinglu. See full changelog.

Security fixes addressing CVE reports; adds experimental SSH-key vault storage (Bitwarden Desktop 2024.12+ required) via feature flag, plus numerous auth/password hint/import fixes and dynamic CSS support.

Security fixes addressing CVEs; update recommended. Notable: improved mobile app compatibility with cleaner datetime formatting; updated emergency access invite email template; README updated.

Org invite URL no longer HTML-encoded; SMTP QUIT handling fixed; collection management fixed in Password Manager; plus Rust 1.82.0, extension-refresh flag, and invite UI tweaks.

This release fixes collection management for managers, resolves Windows compilation issues, includes updates and collection management fixes, and corrects --version behavior when no config is present.

Fixed native mobile sync/login, added CLI to back up SQLite DB, updated email templates for invites and 2FA/login, and included numerous fixes and updates across web-vault, admin pages, migrations, and security.

Security fixes for CVE-2024-39924/39925/39926; update web-vault to 2024.6.2, rollback of password reset enrollment, plus numerous fixes and improvements across login, MFA, note size, Dockerfile, Rust crates, and admin UI.

This release adds beta native mobile apps, drops WebSocket on port 3012, updates web vault to 2024.5.1, and switches EU push endpoint to api.bitwarden.eu, plus numerous fixes and improvements.

Fix: Web API call issue with jQuery 3.7.1; new contributor @calvin-li-developer (first contribution).

WebSockets are now integrated into the HTTP server; the old 3012 setup is deprecated—migrate per the wiki—and the release includes crates, Kubernetes detection, updated GHA workflows, Rust/web-vault, codegen-units, env template fixes, and a Python script, plus a new contributor.

Minor release fixing push notification device registration and .env healthcheck issues; WebSockets now integrated into the main HTTP server, deprecating the 3012-based setup and simplifying proxies per new wiki guidance.

WebSockets live sync is now served by the main HTTP server (no separate 3012 rule); migrate to the new setup, as the old port 3012 will be deprecated and removed in the next release.

Minor release fixes Login with device, restores alpine docker tag, integrates WebSocket live sync into the main HTTP server and deprecates the 3012 proxy setup; see the wiki for migration guidance and the full changelog.

Vaultwarden now serves WebSockets from the main HTTP server (no 3012 rule needed); adds passkey support and web vault 2023.10.0, plus various bug fixes and migration guidance.

Minor release fixes login flow and removes forced master password prompt, LDAP import status, adds login with device, updates images and Rust, optimizes favicon, adds decryption options, new secretsmanager plan, enables auth header for WebSockets, and admin UI improvements.

Minor 1.29.1 release; fixes Org API Key generation on PostgreSQL, external_id issues; adds forwardemail support; removes debug code during attachment download.

Vaultwarden 1.29.0 adds WebSocket over HTTP port (3012 still supported), mobile push, Web Vault 2023.5.0, Directory Connector v2022.11.0, passkeys support, plus numerous fixes and dependency updates.

Vaultwarden is now AGPLv3 licensed, adds Argon2 KDF for clients and admin tokens, and offers beta alternative registries (GHCR and Quay), alongside numerous fixes and improvements.

Adds organization-wide event logs and beta group support, plus a Web Vault update and numerous bugfixes and improvements.

Vaultwarden 1.26.0 adds web vault v2022.10.0, numerous fixes (uploads, 404 catcher, login errors, org revoke, export), API v2 support, CSP tweaks, build updates, improved JWT messages, CreationDate in cipher JSON, and new contributors.

Migrates to the vaultwarden image; patches to prevent corrupted attachments by returning errors; fixes persistent volume checks, CSP/icon redirects, and updates the CI build workflow.

Migrated to vaultwarden image; updated web vault to 2022.6.2, added TMP_FOLDER and password_hints_allowed, persistent volume checks, Firefox CSP fixes, identicon fixes, websocket upgrade to tungstenite, and OpenSSL 111.22.0 with assorted fixes.

Migration urged: switch from bitwardenrs/server to vaultwarden; release adds web vault 2.28.1, Rocket 0.5, async updates, new API endpoints and env path customization, admin login autofocus, CVE fixes, performance/sync improvements, and Rust upgrade.

Migrate to the vaultwarden image; adds external icon support with redirect options, API keys, user/admin login rate limits, Permissions-Policy, caching Expires header, longer email tokens, a Rust CVE fix, and various bug fixes/domain sync.

Migrates from bitwardenrs/server to vaultwarden image; adds email alerts for incomplete 2FA, fixes read_only/hide_passwords conflict, fixes encrypted key after emergency access reject, PostgreSQL migration, macro optimizations, enables trust-dns, updates web vault to 2.25.0.

Migrates from bitwardenrs/server to vaultwarden; adds emergency access, single-organization policy, org bulk user actions; fixes webauthn origin, email caps, import ownership; updates web vault, tzdata, icon fetch, deps; docker builds via GitHub Actions; /alive now checks DB.

Migrate from bitwardenrs/server* to vaultwarden; deprecated after 1.23.0. Highlights: web vault 2.

Migrate to the vaultwarden image from bitwardenrs/server* as old images are deprecated and stop updates after 1.23.0; Alpine builds have been fixed.

Migrate to vaultwarden image; deprecated bitwardenrs images after 1.23.0. New: sends_allowed, hide sender email, send policy, password reprompt, new attachment API with tokenized downloads, webauthn, admin shows overridden vars, updated deps/openssl RSA keys, web vault no T&C.

Renamed project to vaultwarden; docker image migration required; git branch renamed to main; new features: auto-delete trash after X days with configurable purge schedule; improved icon detection; admin page version checks and SQLite backup.

Adds Send functionality, upgrades Web Vault to 2.19.0, fixes CORS, enhances diagnostics page with more info, and updates dependencies.

Release introduces enhanced admin UI (diagnostics, sort users by date, modify user types, delete organizations), experimental LDAP import, Personal Ownership policy, improved Docker SIGTERM handling, web vault 2.18.1, multi-arch builds with buildx and OpenContainers labels, and synced global domains.

Adds a single image with SQLite/MySQL/PostgreSQL support across ARM/AMD64, including Alpine variants; improved DB connection retries, session/item/admin fixes, multi-SMTP auth, per-user favorites, web vault update, and an optional vendored_openssl feature.

Fixed building issues for MySQL/PostgreSQL releases; added user-restricted organization creation; synchronized global_domains.json with upstream.

Fixed vault unlock issue in the desktop client; re-added arm32v6 tag for ARMv6 Docker compatibility; and fixed websocket notifications when sending an item to trash.

Log timestamps now include milliseconds by default with LOG_TIMESTAMP_FORMAT option; restored arm32v6 tag for docker images due to arch detection; release uses docker multiarch images with migration guidance.

Implemented Docker multiarch support; images now auto-detect architecture with unified tags (no arch-specific tags), plus improvements to startup, password masking, and timezone-aware email notifications.

Urgent required update for newer clients: enables soft deletion, redesigned multi-page admin with user verification icons, diagnostics page; web vault 2.14; logs include IP for TOTP failures to aid fail2ban; whitelist fixes; fixed PostgreSQL note deletion; updated deps.

Bug fixes for mobile sync errors and websockets ID, web vault 2.13.2, improved Docker health check with subdirectory support, allow BWRS_VERSION env var to set build version, plus dependency updates and other bug fixes.

Adds organization policies and cipher cloning, updates web vault to 2.13, relaxes SMTP login quoting/casing, updates dependencies, makes panics loggable, and fixes errors when importing into orgs or accepting invites.

Adds subpath support via DOMAIN, per-user/org attachment limits, U2F updates, SMTP test, docker-based web vault, boolean config handling, fix for two-factor/Postgres, email change, punycode domains, icon caching, invite org name option, admin invites, and dependency updates.

Introduces filtered, collapsed logs with debug/trace levels; fixes cipher-page huge-file crash; adds IP_HEADER (default X-Client-IP); prints server time on TOTP failure; guards websockets against panics; adds admin logout, U2F key delete endpoint, and dependency upgrades.

Adds email verification with SIGNUPS_VERIFY toggle, welcome and confirmation emails (change email and account deletion), DataURL favicon support, and dependency updates.

Improved HIBP error with link; allow 1.5-min TOTP drift (disable via AUTHENTICATOR_DISABLE_TIME_DRIFT); cache domain icon blacklist; generate recovery codes for email/Duo 2FA; remove MySQL libs from SQLite; SMTP timeout 15s; Podman-ready images; domain whitelist signups; fix web vault twofactorauth.org; deps updated.

Migration guidance to bitwardenrs/server; PostgreSQL support (experimental), icon blacklist non-global IPs, SQLite binary in images, admin pages offline, CORS, healthcheck, email 2FA, and web vault 2.12.0.

Adds MySQL support (with migration steps), SQLite backup, HIBP v3 with paid key, optional SMTP authentication, admin option to remove 2FA, login-on-new-device alerts, web vault 2.11.0, icon-fetch proxy, and general bug fixes. Migrate to bitwardenrs/server.

Fixed broken U2F in Chrome 74+, added images to email, and updated dependencies.

Release adds Duo 2FA (global or per-user), web vault 2.10.0, LOG_LEVEL for logging, syslog support via USE_SYSLOG, DATA_FOLDER now influences CONFIG_FILE, improved Admin API endpoints, plus other fixes.

Admin panel now hides secrets by default, shows version, and displays read-only settings; adds force-resync, multi-user U2F with names, HTML email version, vault 2.9.0, constant-time password/tokens, new config options, and general dependency fixes.

Adds admin-configurable JSON settings, email templating with Handlebars (reload option), non-upstream icon downloader with disable option, enhanced admin panel badges and session deauth, recovery code for YubiKey, env loading restricted to CWD, a Feature-Policy header, plus fixes.

Minor fix release: enables Yubikey support on AArch64, fixes errors editing cipher with attachments and hiding cipher when deleting attachments, and adds an unofficial server warning.

Added new /admin panel (requires ADMIN_TOKEN; admin_email removed), introduced email invites, web vault v2.8.0, fixed AArch64 build (disables Yubikey), TTLs for icon cache, improved error handling, bug fixes; wiki launched for documentation.

Revamped logging with file/syslog options (disable via EXTENDED_LOGGING); updated web vault to 2.7.1; added key rotation and per-attachment keys; added Yubico support; Rocket web server 0.4; fixes for logout and mobile 2FA crashes.

Websockets disabled by default (enable with WEBSOCKET_ENABLED=true; see README), web vault updated to 2.4.0, sync now avoids sending equivalent domains when unnecessary, plus assorted bug fixes and docs updates.

Adds a simple admin panel for inviting/deleting users as an organization, a new WEBSOCKET_ADDRESS config option, Web Vault Docker updated to 2.4.0 with an aarch64 Dockerfile, dependency updates, and general bug fixes.

Adds partial WebSocket notifications, fixes OpenSSL 1.1.1 compile error, returns default prelogin values when user missing, updates docker web vault to 2.3.0, changes client KDF iterations, and bumps dependencies.

Major release adds web password hints display (with SMTP off), SMTP for hints, new musl/ARMv7 Docker images, Travis CI, KDF prelogin/notification, failed login IP/username, password history, web-vault 2.2, and cipher import for organizations.

Release includes Web Vault updated to 2.1.1, updated dependencies, implementation of share-selected ciphers, and revised user revision date on changes to improve sync reliability.

Adds a password hint feature, fixes the user revision date, and improves documentation.

Adds missing attachment APIs and enables SQLite to run in WAL journal mode for improved concurrency.

Hide organization data from unconfirmed users, update Arch package links, set Rocket default workers to 10 for better performance, and return 404 when a web vault file is missing.

Implemented U2F authentication, enabling hardware security key-based user logins.