Latest server version (1.35.1/2025.12.1) broke something in regards to argon2 token

[muziqaz]

So, I updated my VW server from 2025.07.0 to the latest one.
I had argon2d token set up with fix for the interpolation before the update, and it was working fine with my password for that token. I was always able to login to admin section without issues.
1st thing I noticed when docker-compose up -d, was a string of:

WARN[0000] The "argon2id" variable is not set. Defaulting to a blank string.
WARN[0000] The "v" variable is not set. Defaulting to a blank string.
WARN[0000] The "m" variable is not set. Defaulting to a blank string. 
Etc

At the time of the update I still had the admin section open, so I clicked on diagnostics to see if it got updated to the latest version, and diagnostics page was loading for 40s. Seeing how update was talking about argon2id warning, I checked the token, and it had single $ where it was supposed to be doubled up, even though I generated it with in the past with:
echo -n "mypassword" | argon2 "$(openssl rand -base64 32)" -e -id -k 65540 -t 3 -p 4 | sed 's#\$#\$\$#g'
So I logged out, and loaded vw.domain.com/admin again to log in, and I was presented with yellow warning that I am using plain text admin token. I punched in mypassword, it said wrong token. If I pasted the full frikkin token to the log in field, I was able to log in.
I generated new token with above command line, made sure it generated with doubled up $ characters.
Swapped for new token in docker-compose.yml
Which now looks like this:

services:
 vaultwarden:
  image: vaultwarden/server:latest
  container_name: vaultwarden
  restart: unless-stopped
  ports:
   - ":8080:80"
  volumes:
   - ./vw-data:/data
  environment:
   - ADMIN_TOKEN=$$argon2id$$v=19$$m=65540,t=3,p=4$$SktVa<snip>OD0$$624<snip>

I then docker-compose up -d
Checked conf.json to see if new token has been applied (it was), went to vw.domain.com/admin and again I see yellow warning box that I am using plain text token. And mypassword does not work, instead the whole token is required to be entered to log in. What is happening? Why my argon2id isn't recognised properly after the update?
Thanks

[stefan0xC]

I checked the token, and it had single $ where it was supposed to be doubled up

It should only have single $ in the /admin panel. If you saved it there with $$ (and you have a config.json - which by the way would also take precedence over environment variables) then that would explain why it does not work anymore because the interpolation only applies to docker-compose.yml and not generally.

[muziqaz]

Oh, that is interesting. On a second token generation, I only entered my token with double $ in docker-compose.yml, and did not touch anything in admin panel. And indeed admin panel shows token with double $, same in conf.json (which I did not touch either).
So if I removed every doubled up $ from admin panel field and saved, would that work?

Though the question remains, why conf.json and admin panel have doubled up $ in the first place

[stefan0xC]

And indeed admin panel shows token with double $, same in conf.json (which I did not touch either).

Well, who else but you has access to the /admin panel? Those values don't change on their own. At least there is nothing in our code base that would make this specific change.

So if I removed every doubled up $ from admin panel field and saved, would that work?

In theory yes, Vaultwarden would at least interpret it as an argon2id PHC string.

vaultwarden/src/api/admin.rs

Lines 232 to 244 in bf37657

	Some(t) if t.starts_with("$argon2") => {
	use argon2::password_hash::PasswordVerifier;
	match argon2::password_hash::PasswordHash::new(t) {
	Ok(h) => {
	// NOTE: hash params from `ADMIN_TOKEN` are used instead of what is configured in the `Argon2` instance.
	argon2::Argon2::default().verify_password(token.trim().as_ref(), &h).is_ok()
	}
	Err(e) => {
	error!("The configured Argon2 PHC in `ADMIN_TOKEN` is invalid: {e}");
	false
	}
	}
	}

[muziqaz]

Access to admin is for me only. I removed extra $ from admin panel, saved it, and now I can log in with the password. I'll keep and eye on this on the next update cycle, that I am not thrown off by this, if it happens again.

Thanks for the help :)