Vaultwarden

Security · products/vaultwarden.yaml · RSS

Latest 1.37.4 Oct 5, 2026

Recent releases

1.37.4 Oct 5, 2026 Release notes ↗ 8security8breaking6feature3fix

securityOrganization member revocation [[GHSA-69q9-v8p6-xvx3]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-69q9-v8p6-xvx3) (High, 8.1)

securityTwo-factor authentication [[GHSA-7jg8-8m5x-6j9r]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-7jg8-8m5x-6j9r) (Medium, 6.8)

securityOrganization invitations [[GHSA-v576-3wvq-xh3c]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-v576-3wvq-xh3c) (Medium, 6.8)

1.37.3 Sep 13, 2026 → 1.37.4 Release notes ↗ 6fix2feature2security

securityfix(security): revoke 2FA remember tokens when credentials or 2FA change

securityfix(security): rate limit prelogin and auth request endpoints

1.37.2 Aug 22, 2026 → 1.37.4 Release notes ↗ 3fix1feature

1.37.1 Jul 29, 2026 → 1.37.4 Release notes ↗

1.37.0 Jul 24, 2026 → 1.37.4 Release notes ↗ 9security6fix2feature2breaking

securityFixes GHSA-wc45-m6pv-rrf9: Send access limits not enforced on the new Send access endpoints

securitySSRF via the icon endpoint [[GHSA-hw4g-2v3f-74x5]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-hw4g-2v3f-74x5) [[GHSA-vh5m-fc9v-m84g]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-vh5m-fc9v-m84g) (Medium, 5.8 / 6.3)

securityCross-Organization Cipher Access [[GHSA-xwf8-pjh7-h589]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-xwf8-pjh7-h589) (Medium, 5.9)

1.36.0 May 3, 2026 → 1.37.4 Release notes ↗ 5security4feature6fix

securitySSO Login CSRF GHSA-pfp2-jhgq-6hg5 GHSA-w6h6-8r66-hcv7

securityUser/Organization Enumeration GHSA-hxqh-ff5p-wfr3

securitySSO existing-user binding GHSA-j4j8-gpvj-7fqr GHSA-6x5c-84vm-5j56

1.35.8 Apr 25, 2026 → 1.37.4 Release notes ↗ 3security3fix

securityFixes CVE-2026-47158: CSRF in SSO Authorization Flow

securityFixes CVE-2026-47160: Server-side request forgery (SSRF) via Icon Endpoint Decimal/Hex/Octal IP Bypass

securityFixes CVE-2026-47159: Authentication Flow Information Disclosure in SSO Discovery Allows Organization Enumeration and Pre-Validation Token Exposure

1.35.7 Apr 13, 2026 → 1.37.4 Release notes ↗ 1fix

1.35.6 Apr 12, 2026 → 1.37.4 Release notes ↗ 1fix

1.35.5 Apr 12, 2026 → 1.37.4 Release notes ↗ 3security5feature9fix

securityGHSA-937x-3j8m-7w7p Unconfirmed Owner Can Purge Entire Organization Vault.

securityGHSA-569v-845w-g82p Cross-Org Group Binding Enables Unauthorized Read And Write Access Into Another Organization

securityGHSA-6j4w-g4jh-xjfx Refresh tokens not invalidated on security stamp rotation

1.35.4 Feb 23, 2026 → 1.37.4 Release notes ↗ 4security1fix

securityFixes CVE-2026-43914: Brute-force protection bypass vulnerability

securityGHSA-w9f8-m526-h7fh. This vulnerability would allow an attacker to access a cipher from a different user (fully encrypted) if they already know its internal UUID.

securityGHSA-h4hq-rgvh-wh27. This vulnerability allows an attacker with manager-level access within an organization to modify collections they can access, even if they do not have management permissions for them.

1.35.3 Feb 10, 2026 → 1.37.4 Release notes ↗ 1security4fix

securityGHSA-h265-g7rm-h337 (Publication in process, waiting for CVE assignment) This vulnerability would allow an authenticated attacker that is part of an organization to access items from collections to which the attacker does not belong.

1.35.2 Jan 9, 2026 → 1.37.4 Release notes ↗ 1feature1fix

1.35.1 Dec 30, 2025 → 1.37.4 Release notes ↗ 1fix1feature

1.35.0 Dec 27, 2025 → 1.37.4 Release notes ↗ 15feature23fix2breaking

breakingremove invalid emergency access dummy value

breakingRemove unnecessary output sharing between jobs

Security advisories

5.3 GHSA-wc45-m6pv-rrf9 Send access limits not enforced on the new Send access endpoints

5.3 GHSA-rxhg-2pw9-vf25 Send max_access_count can be exceeded by concurrent access requests

4.3 GHSA-455c-vgg9-jxw8 Failed cipher share leaves a cross-organization collection link that grants access to the cipher

5.8 GHSA-hw4g-2v3f-74x5 Icon endpoint SSRF fix bypass via second-stage favicon IP literal URLs

4.3 GHSA-rqf8-2568-r7mc Manager-with-no-collections can enumerate org user/group → collection mappings (incomplete fix of GHSA-jjxg-p3v6-52ww)

5.5 GHSA-88qc-6ch9-mc3j Directory-connector member import (ldap_import) skips org-policy enforcement (check_user_allowed), bypassing the Single-Organization and required-2FA policies

5.9 GHSA-xwf8-pjh7-h589 Cross-organization full cipher access via unguarded full-access-group query

4.0 GHSA-vh5m-fc9v-m84g SSRF filter bypass (regex not applied post-resolution)

4.3 GHSA-f3qw-qg77-hmm4 IDOR in Organization Import Allows Unauthorized Data Injection

5.3 GHSA-96f7-78q5-j345 Unauthenticated WebSocket connection flooding on /notifications/anonymous-hub (resource-exhaustion DoS)

4.3 GHSA-jq2g-h4xr-4mcr Cipher Ownership Confusion in Organization Import

8.3 CVE-2026-47158 CSRF in SSO Authorization Flow

medium CVE-2026-47159 Authentication Flow Information Disclosure in SSO Discovery Allows Organization Enumeration and Pre-Validation Token Exposure

7.7 CVE-2026-47164 SSO Email Auto-Link Can Bind an Existing Local Account to an Attacker-Controlled IdP Identity

5.8 CVE-2026-47160 Server-side request forgery (SSRF) via Icon Endpoint Decimal/Hex/Octal IP Bypass

medium CVE-2026-33420 Missing authorization check in /organizations/{org_id}/collections/details allows Manager-role users to enumerate all collections

7.3 CVE-2026-43914 Brute-force protection bypass vulnerability

8.1 CVE-2026-43913 Unconfirmed Owner Can Purge Entire Organization Vault

8.7 CVE-2026-43912 Cross-Org Group Binding Enables Unauthorized Read And Write Access Into Another Organization

6.8 CVE-2026-43911 Refresh tokens not invalidated on security stamp rotation

Recent releases

Security advisories

Sources