Android 2026.7.0: Sync fails although /api/sync returns 200 OK (reproducible, depends on vault size)

[grericht]

Prerequisites

• I have searched the existing Closed AND Open Issues AND Discussions
• I have searched and read the documentation

Vaultwarden Support String

Your environment (Generated via diagnostics page)

• Vaultwarden version: v1.37.1
• Web-vault version: v2026.6.4
• OS/Arch: linux/x86_64
• Running within a container: true (Base: Debian)
• Database type: SQLite
• Database version: 3.51.3
• Uses config.json: true
• Uses a reverse proxy: true
• IP Header check: true (X-Real-IP)
• Internet access: true
• Internet access via a proxy: false
• DNS Check: true
• Browser/Server Time Check: true
• Server/NTP Time Check: true
• Domain Configuration Check: true
• HTTPS Check: true
• Websocket Check: true
• HTTP Response Checks: true

Config & Details (Generated via diagnostics page)

Show Config & Details

Environment settings which are overridden: DOMAIN, SIGNUPS_ALLOWED, ADMIN_TOKEN

Config:

{
  "data_folder": "data",
  "database_url": "******://***************",
  "icon_cache_folder": "data/icon_cache",
  "attachments_folder": "data/attachments",
  "sends_folder": "data/sends",
  "tmp_folder": "data/tmp",
  "templates_folder": "data/templates",
  "rsa_key_filename": "data/rsa_key",
  "web_vault_folder": "web-vault/",
  "enable_websocket": true,
  "push_enabled": false,
  "push_relay_uri": "https://push.bitwarden.com",
  "push_identity_uri": "https://identity.bitwarden.com",
  "push_installation_id": "***",
  "push_installation_key": "***",
  "job_poll_interval_ms": 30000,
  "send_purge_schedule": "0 5 * * * *",
  "trash_purge_schedule": "0 5 0 * * *",
  "incomplete_2fa_schedule": "30 * * * * *",
  "emergency_notification_reminder_schedule": "0 3 * * * *",
  "emergency_request_timeout_schedule": "0 7 * * * *",
  "event_cleanup_schedule": "0 10 0 * * *",
  "auth_request_purge_schedule": "30 * * * * *",
  "duo_context_purge_schedule": "30 * * * * *",
  "purge_incomplete_sso_auth": "0 20 0 * * *",
  "domain": "*****://***********************",
  "domain_set": true,
  "domain_origin": "*****://***********************",
  "domain_path": "",
  "web_vault_enabled": true,
  "sends_allowed": true,
  "hibp_api_key": null,
  "user_attachment_limit": null,
  "org_attachment_limit": null,
  "user_send_limit": null,
  "trash_auto_delete_days": null,
  "incomplete_2fa_time_limit": 3,
  "disable_icon_download": true,
  "signups_allowed": false,
  "signups_verify": false,
  "signups_verify_resend_time": 3600,
  "signups_verify_resend_limit": 6,
  "signups_domains_whitelist": "",
  "org_events_enabled": false,
  "org_creation_users": "",
  "invitations_allowed": true,
  "invitation_expiration_hours": 120,
  "emergency_access_allowed": true,
  "email_change_allowed": true,
  "password_iterations": 600000,
  "password_hints_allowed": true,
  "show_password_hint": false,
  "admin_token": "***",
  "invitation_org_name": "Vaultwarden",
  "events_days_retain": null,
  "ip_header": "X-Real-IP",
  "_ip_header_enabled": true,
  "ip_header_trusted_proxies": "local",
  "icon_service": "internal",
  "_icon_service_url": "",
  "_icon_service_csp": "",
  "icon_redirect_code": 302,
  "icon_cache_ttl": 2592000,
  "icon_cache_negttl": 259200,
  "icon_download_timeout": 10,
  "icon_blacklist_regex": null,
  "icon_blacklist_non_global_ips": true,
  "http_request_block_regex": null,
  "http_request_block_non_global_ips": true,
  "disable_2fa_remember": false,
  "authenticator_disable_time_drift": false,
  "experimental_client_feature_flags": "",
  "require_device_email": false,
  "reload_templates": false,
  "extended_logging": true,
  "log_timestamp_format": "%Y-%m-%d %H:%M:%S.%3f",
  "use_syslog": false,
  "log_file": null,
  "log_level": "info",
  "enable_db_wal": true,
  "db_connection_retries": 15,
  "database_timeout": 30,
  "database_idle_timeout": 600,
  "database_max_conns": 10,
  "database_min_conns": 2,
  "database_conn_init": "",
  "disable_admin_token": false,
  "allowed_iframe_ancestors": "",
  "allowed_connect_src": "",
  "login_ratelimit_seconds": 60,
  "login_ratelimit_max_burst": 10,
  "unauthenticated_ratelimit_seconds": 60,
  "unauthenticated_ratelimit_max_burst": 50,
  "admin_ratelimit_seconds": 300,
  "admin_ratelimit_max_burst": 3,
  "admin_session_lifetime": 20,
  "org_groups_enabled": false,
  "increase_note_size_limit": false,
  "_max_note_size": 10000,
  "enforce_single_org_with_reset_pw_policy": false,
  "dns_prefer_ipv6": false,
  "sso_enabled": false,
  "sso_only": false,
  "sso_signups_match_email": true,
  "sso_allow_unknown_email_verification": false,
  "sso_client_id": "",
  "sso_client_secret": "***",
  "sso_authority": "",
  "sso_scopes": "email profile",
  "sso_authorize_extra_params": "",
  "sso_pkce": true,
  "sso_audience_trusted": null,
  "sso_callback_path": "*****://****************************************************",
  "sso_master_password_policy": null,
  "sso_auth_only_not_session": false,
  "sso_client_cache_expiration": 0,
  "sso_debug_tokens": false,
  "_enable_yubico": true,
  "yubico_client_id": null,
  "yubico_secret_key": null,
  "yubico_server": null,
  "_enable_duo": true,
  "duo_use_iframe": false,
  "duo_ikey": null,
  "duo_skey": null,
  "duo_host": null,
  "_duo_akey": null,
  "_enable_smtp": true,
  "use_sendmail": false,
  "sendmail_command": null,
  "smtp_host": "*****************",
  "smtp_ssl": null,
  "smtp_explicit_tls": null,
  "smtp_security": "force_tls",
  "smtp_port": 465,
  "smtp_from": "********************",
  "smtp_from_name": "***********",
  "smtp_username": "********************",
  "smtp_password": "***",
  "smtp_auth_mechanism": null,
  "smtp_timeout": 15,
  "helo_name": null,
  "smtp_embed_images": true,
  "_smtp_img_src": "***:",
  "smtp_debug": false,
  "smtp_accept_invalid_certs": false,
  "smtp_accept_invalid_hostnames": false,
  "_enable_email_2fa": false,
  "email_token_size": 6,
  "email_expiration_time": 600,
  "email_attempts_limit": 3,
  "email_2fa_enforce_on_verified_invite": false,
  "email_2fa_auto_fallback": false
}

Vaultwarden Build Version

1.37.1

Deployment method

Official Container Image

Custom deployment method

Docker container behind Nginx Proxy Manager with Let's Encrypt certificates.

Vaultwarden 1.37.1
Web Vault 2026.6.4
Android Bitwarden 2026.7.0 (Google Play)
HyperOS 3

Reverse Proxy

nginx v2.15.1

Host/Server Operating System

Linux

Operating System Version

HyperOs v3.x

Clients

Android

Client Version

Android Bitwarden 2026.7.0

Steps To Reproduce

1. Log in to the Android Bitwarden app using a Vaultwarden server.
2. Synchronization fails with the message:
   "We couldn't synchronize your vault..."
3. Remove most items from the personal vault while keeping the same account and organizations.
4. Synchronization starts working again.
5. Restore the deleted items.
6. Synchronization fails again.

Additional observations:

• The issue only affects one specific account.
• Another account on the same Android device synchronizes successfully.
• Web Vault, desktop app and browser extension work correctly.
• The server always returns HTTP 200 for /api/sync.

Expected Result

The Android app should successfully synchronize the vault, just like the Web Vault, desktop app and browser extension.

Actual Result

The Android app displays:

"We couldn't synchronize your vault. Your latest changes may not be included..."

The vault is not updated although the Vaultwarden server successfully returns the sync response (HTTP 200).

The problem is reproducible for one account only.

Logs

Vaultwarden server log:

GET /api/sync
(sync) GET /api/sync => 200 OK

No exceptions, SQL errors or panics are logged.

Vaultwarden version:
1.37.1

Web Vault:
2026.6.4

Screenshots or Videos

No response

Additional Context

I spent some time narrowing this down.

The issue does not appear to be server-related.

I can reliably reproduce it by changing the number of items in my personal vault.

When only my two organizations are present, Android synchronization works correctly.

After restoring my personal vault, synchronization starts failing again.

I then repeatedly deleted items until synchronization started working.

The exact items do not seem to matter.

The only consistent observation is that synchronization works with roughly 80 personal items, but fails once significantly more items are present.

Another user account on the same Vaultwarden instance synchronizes correctly on the same Android device.

This suggests that the server response is valid, but the Android client fails while processing the sync response.

[BlackDex]

We would need a more detailed or reproducable way then just these steps.
If you can reproduce it with fake data, please provide this fake data and the steps what to do like create org 1... than org 2, then import x, or add item y or remove z etc....

[grericht]

After some more testing, I no longer believe this is an Android app bug.

The server logs always showed successful logins and successful /api/sync requests (HTTP 200), so the issue was difficult to diagnose.

I eventually discovered that my Vaultwarden instance was using a Let's Encrypt certificate that was shared between multiple hostnames. After issuing a new Let's Encrypt certificate specifically for the Vaultwarden domain and assigning it to the reverse proxy, the Android app started syncing normally again.

Browser clients and the desktop app worked fine the entire time, so the issue only affected the Android app, which made me suspect a client-side problem initially.

At this point, it appears the root cause was related to my TLS/certificate configuration (or how it was presented by the reverse proxy), not Vaultwarden itself.

Sorry for the noise, and thank you for taking the time to review this.

[9Mad-Max5]

Tried the same but didn't help.

[snigapoe]

I having the exact same issue, happen to both my phone and tablet
But I get it working by downgrade to 2026.7.0 version, the problem reproduce whenever it autoupdate to 2026.7.1 again