v1.37.0 (Upgrade to this version when using clients v2026.7.0+)

[dani-garcia]

Note

This update is required for support with clients with version 2026.7.0+, please update before reporting any issues with them.

Security Fixes

This release contains security fixes for the following advisories. We strongly advice to update as soon as possible.

• SSRF via the icon endpoint [GHSA-hw4g-2v3f-74x5] [GHSA-vh5m-fc9v-m84g] (Medium, 5.8 / 6.3)
• Cross-Organization Cipher Access [GHSA-xwf8-pjh7-h589] (Medium, 5.9)
• Organization Policy Bypass on Directory Import [GHSA-88qc-6ch9-mc3j] (Medium, 5.5)
• Send Access-Count Bypass [GHSA-rxhg-2pw9-vf25] (Medium, 5.3)
• Unauthenticated WebSocket Flooding DDOS [GHSA-96f7-78q5-j345] (Medium, 5.3)
• Cross-Organization Secret Sharing [GHSA-455c-vgg9-jxw8] (Medium, 4.3)
• Organization Import Authorization [GHSA-f3qw-qg77-hmm4][GHSA-jq2g-h4xr-4mcr] (Medium, 4.3)
• Organization Data Enumeration via the Manager role [GHSA-rqf8-2568-r7mc] (Medium, 4.3)

These are private for now, pending CVE assignment and publishing at a later date.

What's Changed

• OpenDAL S3 parameter support by @txase in OpenDAL S3 parameter support #6127
• Fix SSO Cookie path by @BlackDex in Fix SSO Cookie path #7187
• fix email 2fa for bw cli by @stefan0xC in fix email 2fa for bw cli #7225
• sso_auth improvements by @Timshel in sso_auth improvements #7197
• Reject unrecognised DATABASE_URL instead of silent SQLite fallback by @mfw78 in Reject unrecognised DATABASE_URL instead of silent SQLite fallback #7061
• Switch to xx-cargo by @dfunkt in Switch to xx-cargo #6640
• Updates and fixes by @BlackDex in Updates and fixes #7235
• Switch to Edition 2024, more clippy lints, and less macro calls by @BlackDex in Switch to Edition 2024, more clippy lints, and less macro calls #7200
• Serve Apple app site association file by @user71424q in Serve Apple app site association file #7191
• Update Rust, Crates and GHA by @BlackDex in Update Rust, Crates and GHA #7307
• Fix enforce blocked by @Timshel in Fix enforce blocked #7246
• Admin password recovery endpoint change by @Timshel in Admin password recovery endpoint change #7270
• fix(sends): emit hideEmail as non-null boolean in sync response by @kvdb in fix(sends): emit hideEmail as non-null boolean in sync response #7283
• Org membership delete remove Invitation by @Timshel in Org membership delete remove Invitation #7284
• [v2026.5.0] Registration request update by @Timshel in [v2026.5.0] Registration request update #7295
• [v2026.5.0] PutPolicy now using vnext format by @Timshel in [v2026.5.0] PutPolicy now using vnext format #7296
• 2026.6.0 send support by @Timshel in 2026.6.0 send support #7346
• Add SSO_AUTHORIZE_BODY by @Timshel in Add SSO_AUTHORIZE_BODY #7357
• Add pm-26340-linux-biometrics-v2 feature flag by @pilotstew in Add pm-26340-linux-biometrics-v2 feature flag #7358
• improve CI by @TriplEight in improve CI #6991
• Misc updates and fixes by @BlackDex in Misc updates and fixes #7406
• Remove old compatibility code by @Timshel in Remove old compatibility code #7434
• Fix compilation with newer rust-musl version by @dfunkt in Fix compilation with newer rust-musl version #7453
• Fix Custom Role CSS for new dialog markup by @tom27052006 in Fix Custom Role CSS for new dialog markup #7442
• Remove unused fields by @Timshel in Remove unused fields #7458
• Update API response, crates and GHA by @BlackDex in Update API response, crates and GHA #7470
• Trusted proxy support, unauthenticated rate limit & other fixes by @dani-garcia in Trusted proxy support, unauthenticated rate limit & other fixes #7472

New Contributors

• @mfw78 made their first contribution in Reject unrecognised DATABASE_URL instead of silent SQLite fallback #7061
• @user71424q made their first contribution in Serve Apple app site association file #7191
• @kvdb made their first contribution in fix(sends): emit hideEmail as non-null boolean in sync response #7283
• @pilotstew made their first contribution in Add pm-26340-linux-biometrics-v2 feature flag #7358
• @TriplEight made their first contribution in improve CI #6991
• @tom27052006 made their first contribution in Fix Custom Role CSS for new dialog markup #7442

Full Changelog: 1.36.0...1.37.0

---

This discussion was created from the release 1.37.0.

[DeanLemans]

This update is required for support with clients with version 2026.7.0+, please update before reporting any issues with them.
but why? what did bitwarder change exactly?

[dani-garcia]

For reference, the PR that fixed the issue: #7434

The short version is that around 8-ish years ago, Bitwarden changed the way the vault items were structured, and Vaultwarden added some backwards compatibility fields to ensure both old and new versions of the clients worked.

These backwards compatibility fields were supposed to be a temporary measure, but for at least the next three years the clients still required them, until we eventually forgot to keep track of them. At some point between 2021 and today, the clients stopped requiring these backwards compatibility fields, but Vaultwarden was still sending them.

This wasn't a problem until Bitwarden decided to use the backwards compatibility fields in a completely different way, which caused the clients to crash.

[jansteffen]

Help, I updated from 1.36 to 1.37 and it somehow erased all users from my database? Everything was fine just a few hours ago, then I decided to redeploy the docker image to fix the issue with the browser extension, suddenly nothing is working, I check the admin panel and it says 0 users???

I'm using a pretty benign compose file...

services:
  vaultwarden:
    image: vaultwarden/server:latest
    container_name: vaultwarden
    restart: on-failure:5
    volumes:
      - ./vaultwarden-data:/data
    environment:
      - DOMAIN=redacted
      - SIGNUPS_ALLOWED=false
      - TZ=Europe/Berlin
    expose:
      - 80
    networks:
      - traefik-net
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.vaultwarden.rule=Host(`redacted`)"
      - "traefik.http.routers.vaultwarden.entrypoints=https"
      - "traefik.http.routers.vaultwarden.tls.certresolver=letsencrypt"
      - "traefik.http.services.vaultwarden.loadbalancer.server.port=80"

networks:
  traefik-net:
    external: true

[BlackDex]

Check your vaultwarden-data directory.

[JustantherMe]

I am on 2026.7.0 (Firefox) and 1.37.0 and my Vault in my Firefox is still not loading.

It stays like this

[obouchet]

I got personally the same issue than you and I wrote a message in that discussion regarding that right away (which I've removed since): removing and reinstalling the extension solved the issue for me. No more endless loading.

[JustantherMe]

Can confirm that reinstalling the plugin fixed the issue.

[BlackDex]

That is probably because the cache prevented the client to continue further in a nice way. Great that this solved it.