v1.37.0 (Upgrade to this version when using clients v2026.7.0+)

[dani-garcia]

Note

This update is required for support with clients with version 2026.7.0+, please update before reporting any issues with them.

Security Fixes

This release contains security fixes for the following advisories. We strongly advice to update as soon as possible.

• SSRF via the icon endpoint [GHSA-hw4g-2v3f-74x5] [GHSA-vh5m-fc9v-m84g] (Medium, 5.8 / 6.3)
• Cross-Organization Cipher Access [GHSA-xwf8-pjh7-h589] (Medium, 5.9)
• Organization Policy Bypass on Directory Import [GHSA-88qc-6ch9-mc3j] (Medium, 5.5)
• Send Access-Count Bypass [GHSA-rxhg-2pw9-vf25] (Medium, 5.3)
• Unauthenticated WebSocket Flooding DDOS [GHSA-96f7-78q5-j345] (Medium, 5.3)
• Cross-Organization Secret Sharing [GHSA-455c-vgg9-jxw8] (Medium, 4.3)
• Organization Import Authorization [GHSA-f3qw-qg77-hmm4][GHSA-jq2g-h4xr-4mcr] (Medium, 4.3)
• Organization Data Enumeration via the Manager role [GHSA-rqf8-2568-r7mc] (Medium, 4.3)

These are private for now, pending CVE assignment and publishing at a later date.

What's Changed

• OpenDAL S3 parameter support by @txase in OpenDAL S3 parameter support #6127
• Fix SSO Cookie path by @BlackDex in Fix SSO Cookie path #7187
• fix email 2fa for bw cli by @stefan0xC in fix email 2fa for bw cli #7225
• sso_auth improvements by @Timshel in sso_auth improvements #7197
• Reject unrecognised DATABASE_URL instead of silent SQLite fallback by @mfw78 in Reject unrecognised DATABASE_URL instead of silent SQLite fallback #7061
• Switch to xx-cargo by @dfunkt in Switch to xx-cargo #6640
• Updates and fixes by @BlackDex in Updates and fixes #7235
• Switch to Edition 2024, more clippy lints, and less macro calls by @BlackDex in Switch to Edition 2024, more clippy lints, and less macro calls #7200
• Serve Apple app site association file by @user71424q in Serve Apple app site association file #7191
• Update Rust, Crates and GHA by @BlackDex in Update Rust, Crates and GHA #7307
• Fix enforce blocked by @Timshel in Fix enforce blocked #7246
• Admin password recovery endpoint change by @Timshel in Admin password recovery endpoint change #7270
• fix(sends): emit hideEmail as non-null boolean in sync response by @kvdb in fix(sends): emit hideEmail as non-null boolean in sync response #7283
• Org membership delete remove Invitation by @Timshel in Org membership delete remove Invitation #7284
• [v2026.5.0] Registration request update by @Timshel in [v2026.5.0] Registration request update #7295
• [v2026.5.0] PutPolicy now using vnext format by @Timshel in [v2026.5.0] PutPolicy now using vnext format #7296
• 2026.6.0 send support by @Timshel in 2026.6.0 send support #7346
• Add SSO_AUTHORIZE_BODY by @Timshel in Add SSO_AUTHORIZE_BODY #7357
• Add pm-26340-linux-biometrics-v2 feature flag by @pilotstew in Add pm-26340-linux-biometrics-v2 feature flag #7358
• improve CI by @TriplEight in improve CI #6991
• Misc updates and fixes by @BlackDex in Misc updates and fixes #7406
• Remove old compatibility code by @Timshel in Remove old compatibility code #7434
• Fix compilation with newer rust-musl version by @dfunkt in Fix compilation with newer rust-musl version #7453
• Fix Custom Role CSS for new dialog markup by @tom27052006 in Fix Custom Role CSS for new dialog markup #7442
• Remove unused fields by @Timshel in Remove unused fields #7458
• Update API response, crates and GHA by @BlackDex in Update API response, crates and GHA #7470
• Trusted proxy support, unauthenticated rate limit & other fixes by @dani-garcia in Trusted proxy support, unauthenticated rate limit & other fixes #7472

New Contributors

• @mfw78 made their first contribution in Reject unrecognised DATABASE_URL instead of silent SQLite fallback #7061
• @user71424q made their first contribution in Serve Apple app site association file #7191
• @kvdb made their first contribution in fix(sends): emit hideEmail as non-null boolean in sync response #7283
• @pilotstew made their first contribution in Add pm-26340-linux-biometrics-v2 feature flag #7358
• @TriplEight made their first contribution in improve CI #6991
• @tom27052006 made their first contribution in Fix Custom Role CSS for new dialog markup #7442

Full Changelog: 1.36.0...1.37.0

---

This discussion was created from the release 1.37.0.

[DeanLemans]

This update is required for support with clients with version 2026.7.0+, please update before reporting any issues with them.
but why? what did bitwarder change exactly?

[dani-garcia]

For reference, the PR that fixed the issue: #7434

The short version is that around 8-ish years ago, Bitwarden changed the way the vault items were structured, and Vaultwarden added some backwards compatibility fields to ensure both old and new versions of the clients worked.

These backwards compatibility fields were supposed to be a temporary measure, but for at least the next three years the clients still required them, until we eventually forgot to keep track of them. At some point between 2021 and today, the clients stopped requiring these backwards compatibility fields, but Vaultwarden was still sending them.

This wasn't a problem until Bitwarden decided to use the backwards compatibility fields in a completely different way, which caused the clients to crash.

[jansteffen]

Help, I updated from 1.36 to 1.37 and it somehow erased all users from my database? Everything was fine just a few hours ago, then I decided to redeploy the docker image to fix the issue with the browser extension, suddenly nothing is working, I check the admin panel and it says 0 users???

I'm using a pretty benign compose file...

services:
  vaultwarden:
    image: vaultwarden/server:latest
    container_name: vaultwarden
    restart: on-failure:5
    volumes:
      - ./vaultwarden-data:/data
    environment:
      - DOMAIN=redacted
      - SIGNUPS_ALLOWED=false
      - TZ=Europe/Berlin
    expose:
      - 80
    networks:
      - traefik-net
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.vaultwarden.rule=Host(`redacted`)"
      - "traefik.http.routers.vaultwarden.entrypoints=https"
      - "traefik.http.routers.vaultwarden.tls.certresolver=letsencrypt"
      - "traefik.http.services.vaultwarden.loadbalancer.server.port=80"

networks:
  traefik-net:
    external: true

[BlackDex]

Check your vaultwarden-data directory.

[jansteffen]

It looks like it just... generated an entirely fresh database, overwriting the old one...

[BlackDex]

That isn't possible to be honest. Vaultwarden doesn't delete a database file, it's not in the code. It either uses it, reads it and runs migrations. But never deletes or wipes it.

Maybe the folder changed? Or something else weird.

[jansteffen]

Oh my god, apparantly because my volume's left side started with ./ it used whatever my container manager (arcane) considered as its working directory as the base, and that was what changed... so it created an entirely new folder with a fresh empty database.

I found the original folder elsewhere, Heart attack over. I'm gonna change that to a fixed path now and stop procrastinating on a backup strategy... ughh....

[BlackDex]

Glad you found the data back!

[JustantherMe]

I am on 2026.7.0 (Firefox) and 1.37.0 and my Vault in my Firefox is still not loading.

It stays like this

[horst789github]

I mean /admin/diagnostics on your Vaultwarden instance.

its all green on diagnostics

EDIT:
i found workaround with the older Firefox Extension version https://addons.mozilla.org/firefox/downloads/file/4915668/bitwarden_password_manager-2026.7.0.xpi
with the newest bitwarden extension the sync is not posible and empty vault

#7607

[Nuc9973]

EDIT: i found workaround with the older Firefox Extension version https://addons.mozilla.org/firefox/downloads/file/4915668/bitwarden_password_manager-2026.7.0.xpi with the newest bitwarden extension the sync is not posible and empty vault

Same issue for me on 1.37.1

Neither Firefox or Edge would work. Downgraded Firefox to Bitwarden 2026.7.0 and it's working.

[halfspawn]

Same issue for me. Thank for the link to old version ...

[flippedcracker]

EDIT: i found workaround with the older Firefox Extension version https://addons.mozilla.org/firefox/downloads/file/4915668/bitwarden_password_manager-2026.7.0.xpi with the newest bitwarden extension the sync is not posible and empty vault

#7607

Thank you for this. I was stuck for days, but downgrading to this fixed it.

[bheikes1]

On server version 1.37.1, Using Bitwarden Addon for Edge 2026.8.0 is busted. Downgrading to 2026.7.0 restored functionality.

[smeitnetworksgithub]

Logout of the extension and log back in, it works like a gem,
was frustrated since yesterday but google pointed us to the right direction,
We had extensions on edge, firefox opera gamxin x, chrome they were all showing empty pages,
as soon as i updated to version 1.37.0 , everything worked

Thankyou Dani Gracia, really appreciate it

[parnanzio]

I keep having problems after upgrading to 1.37.1 from 1.36.0.

With 1.36.0 the Chrome extension wasn't loading vault items correctly, so I upgraded to 1.37.1 and now I'm having bigger problems: there's an error during the master password decryption phase that prevents us from properly accessing the web app anymore (same issue obviously applies to the extension too when not logged in, otherwise it works).

console-log.service.ts:51 Unhandled error in angular TypeError: Failed to execute 'decode' on 'TextDecoder': The encoded data was not valid.
Failed to decrypt private key for user <user-id>

We are using Google as our SSO system. Let me know if you need any other information for debugging.
Same problem for every user of my vault.

[kpfleming]

Is there a reason you haven't upgraded to 1.37.1? It has at least one bug fix compared to 1.37.0.

[parnanzio]

Sorry, my fault.. just updated my previous message: from 1.36.0 to 1.37.1 😅

[BavariaAnde]

I'm experiencing the same issue.

Vaultwarden: 1.37.1
Bitwarden browser extension: 2026.8.0
Browser: [Firefox / Chrome]
Result: vault does not load / appears empty and sync does not work
Downgrading the Bitwarden extension to 2026.7.0 immediately fixes the problem.
So far, 2026.7.0 works correctly against the same Vaultwarden instance, while 2026.8.0 does not.

This appears to be the same issue reported by the other users in this thread.

[BlackDex]

It's a different issue not similar, see #7607