Security Fixes
This release contains security fixes for the following advisories. We strongly advise updating as soon as possible.
- Website icons [GHSA-x9cq-f669-vrr4] (Medium, 5.3)
- Emergency access [GHSA-9pjj-f9g5-3x4c] (Medium, 4.3)
These are private for now, pending CVE assignment and publishing at a later date.
Note
This update is required for web vault 2026.7.1+ to turn two-step login methods on or off, and for 2026.9.0+ to take over an account through emergency access. Please update before reporting any issues with them.
Upgrade notes
- Web vault: the bundled web vault is now v2026.10.1. If you serve your own web vault older than v2026.7.1, you might have compatibility issues.
- Configuration: invalid values now stop startup with an error. Numeric options have tighter types, so negative or too large values are rejected, for example above 65535 for
LOGIN_RATELIMIT_MAX_BURST,TRASH_AUTO_DELETE_DAYS,EVENTS_DAYS_RETAINorSMTP_TIMEOUT, or above 255 forEMAIL_ATTEMPTS_LIMIT. The rate limit*_SECONDSand*_MAX_BURSToptions,DATABASE_TIMEOUTandDATABASE_IDLE_TIMEOUTmust be at least 1,DATABASE_MIN_CONNScan't be larger thanDATABASE_MAX_CONNS, andDUO_CONTEXT_PURGE_SCHEDULEandPURGE_INCOMPLETE_SSO_AUTHmust be empty or a valid cron expression.
What's Changed
- Close WebSocket connections that stop responding by @Cassian433 in #7807
- Validate the Duo and SSO purge schedules on startup by @NotAFlightRisk in #7819
- docs: fix "runnning" typo in playwright README by @ump45nose in #7787
- docs: fix Playwright test env link by @dajiaohuang in #7739
- Fix group import to update groups on data change by @Jogius in #7671
- [Web 2026.9.0] Support new Emergency Access password payload by @tom27052006 in #7746
- [Web 2026.9.0] Support new account recovery password payload by @tom27052006 in #7747
- [web-v2026.7.1] 2FA userVerificationToken for Authenticator, Email and Duo by @Timshel in #7563
- Fix email 2FA for SSO logins on iOS and Android by @dani-garcia in #7827
- Update web-vault to v2026.8.0 by @dani-garcia in #7828
- Add revision_date to org policies by @will-lottkowitz-prism in #7571
- Add Windows desktop Autotype feature flags and policy support by @tom27052006 in #7808
- Add
biometrics-sdk-ipcfeature flag (closes #7812) by @cad0p in #7813 - Delete auth requests when deleting a user by @Cassian433 in #7837
- Add unsupported riscv64 architecture by @BlackDex in #7859
- api/icons: fix typos in the minimum PNG size comment by @ump45nose in #7867
- docs: fix connect-src description grammar by @ump45nose in #7866
- Update dependencies by @BlackDex in #7882
- Misc fixes regarding jobs and config by @BlackDex in #7858
- Send null org key for unconfirmed members in sync by @minchinweb in #7850
- Return stored manage flag for groups in collections/details by @deltatree in #7795
- Fix bulk cipher share response for SDK clients by @tom27052006 in #7831
- Upgrade to Rocket v0.5.2 by @BlackDex in #7890
- Fix typo in vaultwarden.env by @Arthurmeade12 in #7864
- Remove expired cookies from the icon cookie jar by @dani-garcia in #7905
- fix(attachments): enforce quota at v2 metadata reservation by @lucavb in #7450
- Align cipher org checks & attachment notification with upstream by @dani-garcia in #7906
- Document two feature flags in .env.template by @MichaelMuClaude in #7841
- Fix push device unregistration endpoint by @xkmttc in #7891
- Don't return internal error details in bulk member responses; gate SSO token logging by @tauanbinato in #7777
- [Web 2026.9.0] Add Fill Assist + Policy support by @tom27052006 in #7791
- Add registration email verification clicked endpoint by @tom27052006 in #7790
- Make 2FA remember duration configurable by @tom27052006 in #7421
- Bump user revision once for bulk cipher move by @MichaelMuClaude in #7840
- Send logout notification when deleting a user by @Cassian433 in #7839
- Two small fixes for upstream parity by @dani-garcia in #7918
- Add missing HTTP auth and policy revocation audit events by @tom27052006 in #7919
- Clippy fixes, crate and web-vault updates by @BlackDex in #7920
- Escape request values in log messages by @dani-garcia in #7921
New Contributors
- @Cassian433 made their first contribution in #7807
- @NotAFlightRisk made their first contribution in #7819
- @ump45nose made their first contribution in #7787
- @dajiaohuang made their first contribution in #7739
- @Jogius made their first contribution in #7671
- @will-lottkowitz-prism made their first contribution in #7571
- @minchinweb made their first contribution in #7850
- @deltatree made their first contribution in #7795
- @Arthurmeade12 made their first contribution in #7864
- @lucavb made their first contribution in #7450
- @MichaelMuClaude made their first contribution in #7841
- @xkmttc made their first contribution in #7891
- @tauanbinato made their first contribution in #7777
Full Changelog: 1.37.4...1.37.5