Vaultwarden 1.37.0 → 1.37.4
4 releases · 8 breaking changes · 10 security fixes · 0 advisories fixed
10security8breaking0deprecated9feature12fix
Breaking changes
- breaking Reverse proxies: with IP_HEADER=X-Forwarded-For, the client IP is now the rightmost address that isn't in IP_HEADER_TRUSTED_PROXIES (it used to be the leftmost). If you have several proxies in a row, for example a CDN in front of nginx, add all of them to IP_HEADER_TRUSTED_PROXIES. Otherwise the… in 1.37.4
- breaking Sends: bw send receive on CLI 2026.4.2 and older no longer works, the same as against Bitwarden's own servers since v2026.8.0. Creating and managing Sends works on all clients. in 1.37.4
- breaking Feature flags: these flags were removed because no client reads them anymore: ssh-agent, ssh-key-vault-item, mutual-tls, anon-addy-self-host-alias, simple-login-self-host-alias, pm-25373-windows-biometrics-v2, pm-26340-linux-biometrics-v2, desktop-ui-migration-milestone-1 to -4, cxp-import-mobile… in 1.37.4
- breaking Duo: DUO_USE_IFRAME (the deprecated Traditional Prompt) is removed and ignored if set. in 1.37.4
- breaking Custom templates: there's a new email template, email/recover_twofactor, sent after a login with a two-step recovery code. in 1.37.4
- breaking The legacy POST /identity/accounts/register and POST /api/accounts/prelogin endpoints are removed. No current client uses them. in 1.37.4
- breaking Sends cleanup: remove legacy endpoints and align with upstream in 1.37.4
- breaking Remove legacy API endpoints and compatibility code in 1.37.4
Security changes
- security Organization member revocation [[GHSA-69q9-v8p6-xvx3]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-69q9-v8p6-xvx3) (High, 8.1) in 1.37.4
- security Two-factor authentication [[GHSA-7jg8-8m5x-6j9r]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-7jg8-8m5x-6j9r) (Medium, 6.8) in 1.37.4
- security Organization invitations [[GHSA-v576-3wvq-xh3c]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-v576-3wvq-xh3c) (Medium, 6.8) in 1.37.4
- security Attachments [[GHSA-q5x6-grh5-fqgc]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-q5x6-grh5-fqgc) (Medium, 6.5) in 1.37.4
- security Organization event logs [[GHSA-64mc-4p6f-r7x9]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-64mc-4p6f-r7x9) (Medium, 4.3) in 1.37.4
- security Cipher sharing [[GHSA-7ccc-c43j-4p36]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-7ccc-c43j-4p36) (Medium, 4.3) in 1.37.4
- security Organization API key [[GHSA-qwx4-wcv4-mpcv]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-qwx4-wcv4-mpcv) (Low, 3.8) in 1.37.4
- security Additional dependency updates and minor security enhancements in 1.37.4
- security fix(security): revoke 2FA remember tokens when credentials or 2FA change in 1.37.3
- security fix(security): rate limit prelogin and auth request endpoints in 1.37.3
Every release in between
securityOrganization member revocation [[GHSA-69q9-v8p6-xvx3]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-69q9-v8p6-xvx3) (High, 8.1)
securityTwo-factor authentication [[GHSA-7jg8-8m5x-6j9r]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-7jg8-8m5x-6j9r) (Medium, 6.8)
securityOrganization invitations [[GHSA-v576-3wvq-xh3c]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-v576-3wvq-xh3c) (Medium, 6.8)
securityAttachments [[GHSA-q5x6-grh5-fqgc]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-q5x6-grh5-fqgc) (Medium, 6.5)
securityOrganization event logs [[GHSA-64mc-4p6f-r7x9]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-64mc-4p6f-r7x9) (Medium, 4.3)
securityCipher sharing [[GHSA-7ccc-c43j-4p36]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-7ccc-c43j-4p36) (Medium, 4.3)
securityOrganization API key [[GHSA-qwx4-wcv4-mpcv]](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-qwx4-wcv4-mpcv) (Low, 3.8)
securityAdditional dependency updates and minor security enhancements
breakingReverse proxies: with IP_HEADER=X-Forwarded-For, the client IP is now the rightmost address that isn't in IP_HEADER_TRUSTED_PROXIES (it used to be the leftmost). If you have several proxies in a row, for example a CDN in front of nginx, add all of them to IP_HEADER_TRUSTED_PROXIES. Otherwise the…
breakingSends: bw send receive on CLI 2026.4.2 and older no longer works, the same as against Bitwarden's own servers since v2026.8.0. Creating and managing Sends works on all clients.
breakingFeature flags: these flags were removed because no client reads them anymore: ssh-agent, ssh-key-vault-item, mutual-tls, anon-addy-self-host-alias, simple-login-self-host-alias, pm-25373-windows-biometrics-v2, pm-26340-linux-biometrics-v2, desktop-ui-migration-milestone-1 to -4, cxp-import-mobile…
breakingDuo: DUO_USE_IFRAME (the deprecated Traditional Prompt) is removed and ignored if set.
breakingCustom templates: there's a new email template, email/recover_twofactor, sent after a login with a two-step recovery code.
breakingThe legacy POST /identity/accounts/register and POST /api/accounts/prelogin endpoints are removed. No current client uses them.
other[Web 2026.9.0] Support the vault banner policy
featureAdd support for basic auth response client feature flag
other[web-v2026.8.1] store the user key ID
featureAdd organizationsNew and policiesNew to sync response
featureAdd pm-32009-new-item-types feature flag
otherUpdate Crates, GHA and JS
featureAdd pm-34171-card-scanner feature flag
otherset user_created bool for each separate invitation
fixFix revoked org members retaining access to org ciphers
otherEnsure all user checked routes are confirmed
fixFix cortex-a53 build issues when using xx-cargo
featureAdd undetermined-cipher-scenario-logic feature flag (closes #7801)
featureAdd Windows native credential sync to supported feature flags
otherHide the whole change-email section when EMAIL_CHANGE_ALLOWED is false
fixFix Clippy warnings across all targets
otherAdmin reset: 2fa email fallback need a verified email
breakingSends cleanup: remove legacy endpoints and align with upstream
breakingRemove legacy API endpoints and compatibility code
otherAlign API with upstream and remove unwraps
otherUpdate crates, Rust and other dependencies
fixFix password change with newer web-vault
otherchore: remove duplicate "the" in ciphers.rs comment
otherIgnore reset-password auto-enroll when mail is disabled
fixFix migration for MariaDB 12.2.2
featureAdd SSO_SIGNUPS_ALLOWED
otherlog_event take enum parameter not i32
otherMisc Updates
otherUpdate rust docker version
fixFix organization import failing with missing field groups
featureAdd pm-32413-multi-client-password-management feature flag
otherLog IP/username on two-factor email-login credential failures
otherSupport admin reset 2fa
securityfix(security): revoke 2FA remember tokens when credentials or 2FA change
securityfix(security): rate limit prelogin and auth request endpoints
fixfix: Correct invalid comment syntax in .dockerignore
otherUpdate Rust and adjust DockerSettings
otherRoute service clients through shared HTTP setup
fixFix iOS registration token response
otherUse insert_into when possible
fixFix archiveDate update
fixFix Debian cross-linking with xx-cargo
fixFix playwright test
otherMisc fixes and updates
otherInclude user email in successful login logs
fixFix sendmail executable permission check
featureadd dummy revisionDate
otherAlways send initOrganization and orgUserHasExistingUser in invite URL
otherIndirectly resolved #7475 by using newer rust-musl build images which had a compilation issue with OpenSSL.