Upgrading 3.1.4.19 to the latest 3.1.6.1

[g0lgs]

I am testing upgrading 3.1.4.19 to the latest 3.1.6.1 and although it seems to work for most existing users, I get issues when creating new users - they can login but seem to be unable to access any exising passwords

The Apache Error Log shows:

[Thu Jan 29 10:37:47.672558 2026] [php:error] [pid 30252] [client 192.168.2.98:46618] PHP Fatal error: Uncaught Exception: Failed to decrypt with AES (v3: The ciphertext has an invalid padding length (114) compared to the block size (16), v1: AES v1 decryption failed (openssl returned false)) in /var/www/html/teampass/vendor/teampassclasses/cryptomanager/src/CryptoManager.php:313\nStack trace:\n#0 /var/www/html/teampass/sources/main.functions.php(2868): TeampassClasses\\CryptoManager\\CryptoManager::aesDecrypt()\n#1 /var/www/html/teampass/sources/items.queries.php(2810): doDataDecryption()\n#2 {main}\n thrown in /var/www/html/teampass/vendor/teampassclasses/cryptomanager/src/CryptoManager.php on line 313, referer: http://192.168.2.152/index.php?page=items&loginForm

[Sky-W-ui]

known issue, these things help:
1.by some users you just have to wait some time
2. User have to generate new keys or change password

[guerricv]

Hello,

I'm trying to reproduce the issue. Can you please tell me if you are using local TP account or AD / Oauth2 accounts ?
Also, can it be issue for users who have not log in since a while ?

[g0lgs]

The issue appears to be both for new local TP users and some AD Users

[g0lgs]

known issue, these things help: 1.by some users you just have to wait some time 2. User have to generate new keys or change password

I have tried (as admin) resetting user password and it is still the same.

[Sky-W-ui]

Can you check the following tables in the database:

1. teampass_users -> check following columns of the users that have the problem encryption version (should be version 3) and encrytion migration (Should be 1 for migration complete) completed
2. teampass_sharekeys_items -> Check the colums encryption version for the user id of the users that didnt work. When i got the problem with an existing user the encryption value of the user had still version 1 for all items. After the password change it created the new keys and used the new encryption version.

[g0lgs]

If I have understood what you mean correctly:

mysql> select id,login,encryption_version,phpseclibv3_migration_completed from teampass_users where id in (10000033);

+----------+-----------+--------------------+---------------------------------+
| id       | login     | encryption_version | phpseclibv3_migration_completed |
+----------+-----------+--------------------+---------------------------------+
| 10000033 | ianh      |                  3 |                               1 |
+----------+-----------+--------------------+---------------------------------+
3 rows in set (0.00 sec)

select user_id,encryption_version from teampass_sharekeys_items where user_id in (10000033);

Shows version 3 in all items for that affected user (where I have reset the users password) , but version 1 for some other users with the same symptoms.

[Sky-W-ui]

Thats what i meant yeah.
With the user shown above you changed the password and in teampass_sharekeys_items all items with this userid is shown with encryption version 3?
But still items are permaloading and you get the errormessage in the apache?
The other users with the problem that still shows encryption version 1 in sharekeys_items and there you didnt change password for now?
In my case i could access the passwords after changing the password and i got the same symptons like you.
A other user changed the keys of the user and it worked for him.
Looke here: #5055
Can you try again to access the items with the user above. Maybe it just needs some time.
I will test it again later today on my test system. Maybe I find something to help you and my solution was just a stroke of luck.

[g0lgs]

Yes all items in teampass_sharekeys_items show version 3 for user 10000033

and still getting the error in apache error log.

I have 2 TP only users where I have changed the password and both appear to have same issue.

The other users the password has not been changed as they are currently configured to use AD.

[Sky-W-ui]

I tested it again on my testsystem
After upgrading from 3.1.5.21 -> 3.1.6.1 I have the same issue as you with one of my local users.
the sharekeys_items entries for this user dont change the sharekeys to version 3 and when trying to access one item i get the same error as you. The only difference is that the value of my padding length is 24 instead of your 114. But i think this shouldnt be an issue.
Now when i change the password from this user through the admin console and relog with the user i have access to all items without a problem.
Here is my errorcode for reference:

[Fri Jan 30 13:32:05.636657 2026] [php:error] [pid 4635] [client 127.0.0.1:38544] PHP Fatal error:  Uncaught Exception: Failed to decrypt with AES (v3: The ciphertext has an invalid padding length (24) compared to the block size (16), v1: AES v1 decryption failed (openssl returned false)) in /var/www/html/TeamPass/vendor/teampassclasses/cryptomanager/src/CryptoManager.php:313
Stack trace:
#0 /var/www/html/TeamPass/sources/main.functions.php(2868): TeampassClasses\\CryptoManager\\CryptoManager::aesDecrypt()
#1 /var/www/html/TeamPass/sources/items.queries.php(2810): doDataDecryption()
#2 {main}
  thrown in /var/www/html/TeamPass/vendor/teampassclasses/cryptomanager/src/CryptoManager.php on line 313, referer: https://xxxx/index.php?page=items&loginForm

[Sky-W-ui]

Just saw that Nils released 3.1.6.2
I will reset my testsystem and upgrade to 3.1.6.2 and check if it solves the problem on my side. I will give you a update later

[Sky-W-ui]

Tested on the new version 3.1.6.2. I have still the same issue.
This time i used the solution of the other post and just generate new keys through the user and then it worked.
Can you test generating new keys please and tell us if its works on your side?

[g0lgs]

So I have now updated 3.1.6.1 to 3.1.6.3 and tried reseting / changing user passwords and Generating new user Keys and I am still getting decryption errors and still get odd performance issues (not able to view of edit passwords) and the Apache Error log still gets errors - it seems that the exact error changes depending on which passwords I try to access.

[Mon Feb 02 11:28:15.286476 2026] [php:error] [pid 62205] [client 192.168.2.98:50372] PHP Fatal error:  Uncaught Exception: Failed to decrypt with AES (v3: The ciphertext has an invalid padding length (114) compared to the block size (16), v1: AES v1 decryption failed (openssl returned false)) in /var/www/html/teampass/vendor/teampassclasses/cryptomanager/src/CryptoManager.php:313\nStack trace:\n#0 /var/www/html/teampass/sources/main.functions.php(2869): TeampassClasses\\CryptoManager\\CryptoManager::aesDecrypt()\n#1 /var/www/html/teampass/sources/items.queries.php(2810): doDataDecryption()\n#2 {main}\n  thrown in /var/www/html/teampass/vendor/teampassclasses/cryptomanager/src/CryptoManager.php on line 313, referer: http://192.168.2.152/index.php?page=items
[Mon Feb 02 11:29:24.821620 2026] [php:error] [pid 62206] [client 192.168.2.98:38818] PHP Fatal error:  Uncaught Exception: Failed to decrypt with AES (v3: The ciphertext has an invalid padding length (72) compared to the block size (16), v1: AES v1 decryption failed (openssl returned false)) in /var/www/html/teampass/vendor/teampassclasses/cryptomanager/src/CryptoManager.php:313\nStack trace:\n#0 /var/www/html/teampass/sources/main.functions.php(2869): TeampassClasses\\CryptoManager\\CryptoManager::aesDecrypt()\n#1 /var/www/html/teampass/sources/items.queries.php(2810): doDataDecryption()\n#2 {main}\n  thrown in /var/www/html/teampass/vendor/teampassclasses/cryptomanager/src/CryptoManager.php on line 313, referer: http://192.168.2.152/index.php?page=items
[Mon Feb 02 11:29:45.649352 2026] [php:error] [pid 62205] [client 192.168.2.98:55788] PHP Fatal error:  Uncaught Exception: Failed to decrypt with AES (v3: The ciphertext has an invalid padding length (182) compared to the block size (16), v1: AES v1 decryption failed (openssl returned false)) in /var/www/html/teampass/vendor/teampassclasses/cryptomanager/src/CryptoManager.php:313\nStack trace:\n#0 /var/www/html/teampass/sources/main.functions.php(2869): TeampassClasses\\CryptoManager\\CryptoManager::aesDecrypt()\n#1 /var/www/html/teampass/sources/items.queries.php(2810): doDataDecryption()\n#2 {main}\n  thrown in /var/www/html/teampass/vendor/teampassclasses/cryptomanager/src/CryptoManager.php on line 313, referer: http://192.168.2.152/index.php?page=items

I aslo noticed that the Email sent after resetting a user password does not contain the password but just a message like 'email_body_user_config_3' or 'email_body_user_config_4'

[g0lgs]

I can create and then view / edit new password entries, just not view most of the others that the account should have access too (I did manage to access one that I randomly tried of the 300+ in the system)

[Sky-W-ui]

I aslo noticed that the Email sent after resetting a user password does not contain the password but just a message like 'email_body_user_config_3' or 'email_body_user_config_4'

I think that's a new bug from 3.1.6.2 -> 3.1.6.3 because i upgraded my testsystem on 6.1.6.3 today and tested some things. One thing sent me a mail and i got this error as well. The exact same process on 3.1.6.2 got me a correct display.

I can create and then view / edit new password entries, just not view most of the others that the account should have access too (I did manage to access one that I randomly tried of the 300+ in the system)

From your error description it is the exact same error as by my side. Even that i could randomly open one specific password correctly. i have about 250 passwords in my testsystem. It was the same password in every test i did for the error.
So i am really confused why the workaround with either changing password or generating new keys dont work for you. :(

@guerricv could you replicate the error somehow or do you have some ideas. I am out of ideas for now...

[guerricv]

Hello,

Unfortunately I was not able to reproduce errors you got. It sounds to me like missing sharekeys on TP user side or users side.
If you have a user who can access all items, maybe you can try something.