Vaultwarden 1.35.3 → 1.36.0
6 releases · 0 breaking changes · 15 security fixes · 9 advisories fixed
15security0breaking0deprecated9feature21fix
Vulnerabilities fixed by this upgrade
- 8.3 CVE-2026-47158 CSRF in SSO Authorization Flow
- medium CVE-2026-47159 Authentication Flow Information Disclosure in SSO Discovery Allows Organization Enumeration and Pre-Validation Token Exposure
- 7.7 CVE-2026-47164 SSO Email Auto-Link Can Bind an Existing Local Account to an Attacker-Controlled IdP Identity
- 5.8 CVE-2026-47160 Server-side request forgery (SSRF) via Icon Endpoint Decimal/Hex/Octal IP Bypass
- 7.3 CVE-2026-43914 Brute-force protection bypass vulnerability
- 8.1 CVE-2026-43913 Unconfirmed Owner Can Purge Entire Organization Vault
- 8.7 CVE-2026-43912 Cross-Org Group Binding Enables Unauthorized Read And Write Access Into Another Organization
- 6.8 CVE-2026-43911 Refresh tokens not invalidated on security stamp rotation
- 4.3 CVE-2026-31835 Vaultwarden: WebAuthn assertion processed before signature verification allows persistent credential backup-flag tampering
Breaking changes
None in the release notes.
Security changes
- security SSO Login CSRF GHSA-pfp2-jhgq-6hg5 GHSA-w6h6-8r66-hcv7 in 1.36.0
- security User/Organization Enumeration GHSA-hxqh-ff5p-wfr3 in 1.36.0
- security SSO existing-user binding GHSA-j4j8-gpvj-7fqr GHSA-6x5c-84vm-5j56 in 1.36.0
- security SSRF via Icon Endpoint GHSA-72vh-x5jq-m82g in 1.36.0
- security Some crate's updated and other minor security enhancements in 1.36.0
- security Fixes CVE-2026-47158: CSRF in SSO Authorization Flow in 1.35.8
- security Fixes CVE-2026-47160: Server-side request forgery (SSRF) via Icon Endpoint Decimal/Hex/Octal IP Bypass in 1.35.8
- security Fixes CVE-2026-47159: Authentication Flow Information Disclosure in SSO Discovery Allows Organization Enumeration and Pre-Validation Token Exposure in 1.35.8
- security GHSA-937x-3j8m-7w7p Unconfirmed Owner Can Purge Entire Organization Vault. in 1.35.5
- security GHSA-569v-845w-g82p Cross-Org Group Binding Enables Unauthorized Read And Write Access Into Another Organization in 1.35.5
- security GHSA-6j4w-g4jh-xjfx Refresh tokens not invalidated on security stamp rotation in 1.35.5
- security Fixes CVE-2026-43914: Brute-force protection bypass vulnerability in 1.35.4
- security GHSA-w9f8-m526-h7fh. This vulnerability would allow an attacker to access a cipher from a different user (fully encrypted) if they already know its internal UUID. in 1.35.4
- security GHSA-h4hq-rgvh-wh27. This vulnerability allows an attacker with manager-level access within an organization to modify collections they can access, even if they do not have management permissions for them. in 1.35.4
- security GHSA-r32r-j5jq-3w4m. This vulnerability allows an attacker with manager-level access within an organization to modify collections they are not assigned. in 1.35.4
Every release in between
securitySSO Login CSRF GHSA-pfp2-jhgq-6hg5 GHSA-w6h6-8r66-hcv7
securityUser/Organization Enumeration GHSA-hxqh-ff5p-wfr3
securitySSO existing-user binding GHSA-j4j8-gpvj-7fqr GHSA-6x5c-84vm-5j56
securitySSRF via Icon Endpoint GHSA-72vh-x5jq-m82g
securitySome crate's updated and other minor security enhancements
otherWeb Vault updated to v2026.4.1
otherSSO fallback to UserInfo preferred_username
otherDummy identifier need to pass for a guid
featureadd new /identity/accounts/prelogin/password
featureAdd DuckDuckGo browser device type
otherApply duration_suboptimal_units lint findings
otherApply ref_option lint findings
fixFix hardcoded sso identifier
fixUpdate crates and fix a nightly lint
fixFix Host/IP resolving
otherSeveral SSO Fixes
featureAdd support for archiving items
fixFix favicon fetching to check all icon links instead of just the first one
fixFix merge conflict
otherReplace organization_uuid unwrap with proper error handling
fixfix: return Err instead of panic on unknown cipher atype in to_json()
featureAllow SQLite to be linked against dynamically
otherUpdate crates and web-vault
otherUpdate hickory
securityFixes CVE-2026-47158: CSRF in SSO Authorization Flow
securityFixes CVE-2026-47160: Server-side request forgery (SSRF) via Icon Endpoint Decimal/Hex/Octal IP Bypass
securityFixes CVE-2026-47159: Authentication Flow Information Disclosure in SSO Discovery Allows Organization Enumeration and Pre-Validation Token Exposure
otherDummy org Master password policy auth fix
fixFix recovery-code not working
fixFix invalid refresh token response
fixUpdate Rust, Crates, GHA and fix a DNS issue
otherUpdate web-vault and crates
fixFix 2FA for Android
fixFix MFA Remember
securityGHSA-937x-3j8m-7w7p Unconfirmed Owner Can Purge Entire Organization Vault.
securityGHSA-569v-845w-g82p Cross-Org Group Binding Enables Unauthorized Read And Write Access Into Another Organization
securityGHSA-6j4w-g4jh-xjfx Refresh tokens not invalidated on security stamp rotation
otherThe admin templates have changed, please update them if you override these via templates.
otherTwo Factor Remember Tokens are now valid for max 30 days. Old tokens are invalid directly after upgrading.
otherapply policies only to confirmed members
featureFeat(config): add feature flag for Safari account switching
fixfix: add ForcePasswordReset to api key login
featureAdd Webauthn related origins flag to known flags.
featureAdd 30s cache to SSO exchange_refresh_token
featureAdd cxp-import-mobile and cxp-export-mobile: feature flags on mobile
otherMisc updates and fixes
featureSupport new desktop origin on CORS
fixFix checkout action version
fixFix apikey login
fixFix email header base64 padding
otherUpdate Feature Flags
otherUpdate crates and GHA
otherUse protected CI environment
fixFix 2FA Remember to actually be 30 days
otherMisc Updates
otherSwitch to attest action
otherRotate refresh-tokens on sstamp reset
otherMisc org fixes
fixFix empty string FolderId
otherDisable deployments for release env
fixFix Send icons
otherprevent managers from creating collections
otherChange SQLite backup to use VACUUM INTO query
otherHandle SIGTERM and SIGQUIT shutdown signals.
otherDo not display unavailable 2FA options
fixFix logout push identifiers and send logout before clearing devices
fixFix windows build issues
otherCrate and GHA updates
securityFixes CVE-2026-43914: Brute-force protection bypass vulnerability
securityGHSA-w9f8-m526-h7fh. This vulnerability would allow an attacker to access a cipher from a different user (fully encrypted) if they already know its internal UUID.
securityGHSA-h4hq-rgvh-wh27. This vulnerability allows an attacker with manager-level access within an organization to modify collections they can access, even if they do not have management permissions for them.
securityGHSA-r32r-j5jq-3w4m. This vulnerability allows an attacker with manager-level access within an organization to modify collections they are not assigned.
otherUpdate Rust and Crates and GHA
otherhide remember 2fa token
fixfix(send_invite): invite links
otherMisc organization fixes