Vaultwarden 1.37.1 → 1.37.5

Vulnerabilities fixed by this upgrade

• 4.3 GHSA-9pjj-f9g5-3x4c Emergency access
• 5.3 GHSA-x9cq-f669-vrr4 Website icons
• 4.3 GHSA-7ccc-c43j-4p36 Organization member can move personal items into an organization without collection access
• 8.1 GHSA-69q9-v8p6-xvx3 Revoked or unconfirmed organization member retains read and delete access to organization ciphers
• 6.5 GHSA-q5x6-grh5-fqgc Unbounded client-declared attachment fileSize causes an out-of-bounds panic that permanently breaks vault sync for every user who can see the cipher
• 6.8 GHSA-v576-3wvq-xh3c Loop-carried user_created flag in send_invite deletes a pre-existing user's account and entire vault when an invite e-mail fails
• 4.3 GHSA-64mc-4p6f-r7x9 Revoked or unconfirmed organization Admin can read cipher audit logs
• 3.8 GHSA-qwx4-wcv4-mpcv Organization Admin can revoke and delete Owners through an Admin-mintable organization API key
• 6.8 GHSA-7jg8-8m5x-6j9r vaultwarden: device-level 2FA "remember" tokens survive admin-initiated 2FA removal, allowing 2FA bypass for up to 30 days (residual gap in fix f1ff613)

Breaking changes

• breaking Web vault: the bundled web vault is now v2026.10.1. If you serve your own web vault older than v2026.7.1, you might have compatibility issues. in 1.37.5
• breaking Configuration: invalid values now stop startup with an error. Numeric options have tighter types, so negative or too large values are rejected, for example above 65535 for LOGIN_RATELIMIT_MAX_BURST, TRASH_AUTO_DELETE_DAYS, EVENTS_DAYS_RETAIN or SMTP_TIMEOUT, or above 255 for EMAIL_ATTEMPTS_LIMIT.… in 1.37.5
• breaking Remove expired cookies from the icon cookie jar in 1.37.5
• breaking Reverse proxies: with IP_HEADER=X-Forwarded-For, the client IP is now the rightmost address that isn't in IP_HEADER_TRUSTED_PROXIES (it used to be the leftmost). If you have several proxies in a row, for example a CDN in front of nginx, add all of them to IP_HEADER_TRUSTED_PROXIES. Otherwise the… in 1.37.4
• breaking Sends: bw send receive on CLI 2026.4.2 and older no longer works, the same as against Bitwarden's own servers since v2026.8.0. Creating and managing Sends works on all clients. in 1.37.4
• breaking Feature flags: these flags were removed because no client reads them anymore: ssh-agent, ssh-key-vault-item, mutual-tls, anon-addy-self-host-alias, simple-login-self-host-alias, pm-25373-windows-biometrics-v2, pm-26340-linux-biometrics-v2, desktop-ui-migration-milestone-1 to -4, cxp-import-mobile… in 1.37.4
• breaking Duo: DUO_USE_IFRAME (the deprecated Traditional Prompt) is removed and ignored if set. in 1.37.4
• breaking Custom templates: there's a new email template, email/recover_twofactor, sent after a login with a two-step recovery code. in 1.37.4
• breaking The legacy POST /identity/accounts/register and POST /api/accounts/prelogin endpoints are removed. No current client uses them. in 1.37.4
• breaking When using a MariaDB or MySQL server which does not support native TLS/SSL encrypted connections, using the Alpine image of Vaultwarden might fail to connect. Add MARIADB_TLS_DISABLE_PEER_VERIFICATION=1 as an environment variable to your Vaultwarden server environment, and it will start running… in 1.37.4
• breaking Sends cleanup: remove legacy endpoints and align with upstream in 1.37.4
• breaking Remove legacy API endpoints and compatibility code in 1.37.4

Security changes

• security Website icons GHSA-x9cq-f669-vrr4 (Medium, 5.3) in 1.37.5
• security Emergency access GHSA-9pjj-f9g5-3x4c (Medium, 4.3) in 1.37.5
• security Organization member revocation GHSA-69q9-v8p6-xvx3 (High, 8.1) in 1.37.4
• security Two-factor authentication GHSA-7jg8-8m5x-6j9r (Medium, 6.8) in 1.37.4
• security Organization invitations GHSA-v576-3wvq-xh3c (Medium, 6.8) in 1.37.4
• security Attachments GHSA-q5x6-grh5-fqgc (Medium, 6.5) in 1.37.4
• security Organization event logs GHSA-64mc-4p6f-r7x9 (Medium, 4.3) in 1.37.4
• security Cipher sharing GHSA-7ccc-c43j-4p36 (Medium, 4.3) in 1.37.4
• security Organization API key GHSA-qwx4-wcv4-mpcv (Low, 3.8) in 1.37.4
• security Additional dependency updates and minor security enhancements in 1.37.4
• security fix(security): revoke 2FA remember tokens when credentials or 2FA change in 1.37.3
• security fix(security): rate limit prelogin and auth request endpoints in 1.37.3

Every release in between