Home

Software-update: Vaultwarden 1.37.5

Vaultwarden is een onofficiële in Rust ontwikkelde implementatie van de Bitwarden-wachtwoordmanager. Het gaat alleen om de serverkant van de wachtwoordmanager; voor de clients kan de officiële software van Bitwarden worden gebruikt. Vaultwarden is lichter in gebruik en heeft ook functionaliteit waarvoor bij Bitwarden moet worden betaald, waaronder het kunnen opslaan van bijlagen en beheer van wachtwoorden op organisatieniveau. Versie 1.37.4 van Vaultwarden is uitgekomen en hier zijn de volgende verbeteringen in aangebracht:

Security Fixes

This release contains security fixes for the following advisories. We strongly advise updating as soon as possible.

  • Website icons [GHSA-x9cq-f669-vrr4] (Medium, 5.3)
    • Medium
  • Emergency access [GHSA-9pjj-f9g5-3x4c] (Medium, 4.3)
    • Medium

    These are private for now, pending CVE assignment and publishing at a later date.

    Note

    This update is required for web vault 2026.7.1+ to turn two-step login methods on or off, and for 2026.9.0+ to take over an account through emergency access. Please update before reporting any issues with them.

    Upgrade notes
  • Web vault: the bundled web vault is now v2026.10.1. If you serve your own web vault older than v2026.7.1, you might have compatibility issues.
    • Web vault:
  • Configuration: invalid values now stop startup with an error. Numeric options have tighter types, so negative or too large values are rejected, for example above 65535 for LOGIN_RATELIMIT_MAX_BURST, TRASH_AUTO_DELETE_DAYS, EVENTS_DAYS_RETAIN or SMTP_TIMEOUT, or above 255 for EMAIL_ATTEMPTS_LIMIT. The rate limit *_SECONDS and *_MAX_BURST options, DATABASE_TIMEOUT and DATABASE_IDLE_TIMEOUT must be at least 1, DATABASE_MIN_CONNS can't be larger than DATABASE_MAX_CONNS, and DUO_CONTEXT_PURGE_SCHEDULE and PURGE_INCOMPLETE_SSO_AUTH must be empty or a valid cron expression.
    • Configuration:What's Changed
  • Close WebSocket connections that stop responding in #7807
  • Validate the Duo and SSO purge schedules on startup in #7819
  • docs: fix "runnning" typo in playwright README in #7787
  • docs: fix Playwright test env link in #7739
  • Fix group import to update groups on data change in #7671
  • [Web 2026.9.0] Support new Emergency Access password payload in #7746
  • [Web 2026.9.0] Support new account recovery password payload in #7747
  • [web-v2026.7.1] 2FA userVerificationToken for Authenticator, Email and Duo in #7563
  • Fix email 2FA for SSO logins on iOS and Android in #7827
  • Update web-vault to v2026.8.0 in #7828
  • Add revision_date to org policies in #7571
  • Add Windows desktop Autotype feature flags and policy support in #7808
  • Add biometrics-sdk-ipc feature flag (closes #7812) in #7813
  • Delete auth requests when deleting a user in #7837
  • Add unsupported riscv64 architecture in #7859
  • api/icons: fix typos in the minimum PNG size comment in #7867
  • docs: fix connect-src description grammar in #7866
  • Update dependencies in #7882
  • Misc fixes regarding jobs and config in #7858
  • Send null org key for unconfirmed members in sync in #7850
  • Return stored manage flag for groups in collections/details in #7795
  • Fix bulk cipher share response for SDK clients in #7831
  • Upgrade to Rocket v0.5.2 in #7890
  • Fix typo in vaultwarden.env in #7864
  • Remove expired cookies from the icon cookie jar in #7905
  • fix(attachments): enforce quota at v2 metadata reservation in #7450
  • Align cipher org checks & attachment notification with upstream in #7906
  • Document two feature flags in .env.template in #7841
  • Fix push device unregistration endpoint in #7891
  • Don't return internal error details in bulk member responses; gate SSO token logging in #7777
  • [Web 2026.9.0] Add Fill Assist + Policy support in #7791
  • Add registration email verification clicked endpoint in #7790
  • Make 2FA remember duration configurable in #7421
  • Bump user revision once for bulk cipher move in #7840
  • Send logout notification when deleting a user in #7839
  • Two small fixes for upstream parity in #7918
  • Add missing HTTP auth and policy revocation audit events in #7919
  • Clippy fixes, crate and web-vault updates in #7920
  • Escape request values in log messages in #7921

    • Source: Tweakers.net

    Previous

    Next