Vaultwarden 1.37.4 → 1.37.5
1 release · 3 breaking changes · 2 security fixes · 2 advisories fixed
2security3breaking0deprecated9feature8fix
Vulnerabilities fixed by this upgrade
- 4.3 GHSA-9pjj-f9g5-3x4c Emergency access
- 5.3 GHSA-x9cq-f669-vrr4 Website icons
Breaking changes
- breaking Web vault: the bundled web vault is now v2026.10.1. If you serve your own web vault older than v2026.7.1, you might have compatibility issues. in 1.37.5
- breaking Configuration: invalid values now stop startup with an error. Numeric options have tighter types, so negative or too large values are rejected, for example above 65535 for LOGIN_RATELIMIT_MAX_BURST, TRASH_AUTO_DELETE_DAYS, EVENTS_DAYS_RETAIN or SMTP_TIMEOUT, or above 255 for EMAIL_ATTEMPTS_LIMIT.… in 1.37.5
- breaking Remove expired cookies from the icon cookie jar in 1.37.5
Security changes
- security Website icons GHSA-x9cq-f669-vrr4 (Medium, 5.3) in 1.37.5
- security Emergency access GHSA-9pjj-f9g5-3x4c (Medium, 4.3) in 1.37.5
Every release in between
securityWebsite icons GHSA-x9cq-f669-vrr4 (Medium, 5.3)
securityEmergency access GHSA-9pjj-f9g5-3x4c (Medium, 4.3)
breakingWeb vault: the bundled web vault is now v2026.10.1. If you serve your own web vault older than v2026.7.1, you might have compatibility issues.
breakingConfiguration: invalid values now stop startup with an error. Numeric options have tighter types, so negative or too large values are rejected, for example above 65535 for LOGIN_RATELIMIT_MAX_BURST, TRASH_AUTO_DELETE_DAYS, EVENTS_DAYS_RETAIN or SMTP_TIMEOUT, or above 255 for EMAIL_ATTEMPTS_LIMIT.…
otherClose WebSocket connections that stop responding
otherValidate the Duo and SSO purge schedules on startup
otherdocs: fix "runnning" typo in playwright README
otherdocs: fix Playwright test env link
fixFix group import to update groups on data change
feature[Web 2026.9.0] Support new Emergency Access password payload
feature[Web 2026.9.0] Support new account recovery password payload
other[web-v2026.7.1] 2FA userVerificationToken for Authenticator, Email and Duo
fixFix email 2FA for SSO logins on iOS and Android
otherUpdate web-vault to v2026.8.0
featureAdd revision_date to org policies
featureAdd Windows desktop Autotype feature flags and policy support
featureAdd biometrics-sdk-ipc feature flag (closes #7812)
otherDelete auth requests when deleting a user
featureAdd unsupported riscv64 architecture
fixapi/icons: fix typos in the minimum PNG size comment
otherdocs: fix connect-src description grammar
otherUpdate dependencies
otherMisc fixes regarding jobs and config
otherSend null org key for unconfirmed members in sync
otherReturn stored manage flag for groups in collections/details
fixFix bulk cipher share response for SDK clients
otherUpgrade to Rocket v0.5.2
fixFix typo in vaultwarden.env
breakingRemove expired cookies from the icon cookie jar
fixfix(attachments): enforce quota at v2 metadata reservation
otherAlign cipher org checks & attachment notification with upstream
otherDocument two feature flags in .env.template
fixFix push device unregistration endpoint
otherDon't return internal error details in bulk member responses; gate SSO token logging
feature[Web 2026.9.0] Add Fill Assist + Policy support
featureAdd registration email verification clicked endpoint
otherMake 2FA remember duration configurable
otherBump user revision once for bulk cipher move
fixTwo small fixes for upstream parity
featureAdd missing HTTP auth and policy revocation audit events
+3 more items in the release notes