Vaultwarden - Package Updates

[Package Updates]

[1.23.2]

• Update vaultwarden to 1.35.2
• Full Changelog
• update web-vault to fix org creation by @stefan0xC in #6646
• return no content with status code 204 by @stefan0xC in #6665
• allow MasterPasswordHash for Android by @stefan0xC in #6673
• improve sso callback path by @stefan0xC in #6676
• Fix web-vault version check and update web-vault by @BlackDex in #6686

[Package Updates]

[1.24.0]

• OIDC auth implemented

[Package Updates]

[1.24.1]

• Fix up postinstall and checklist

[Package Updates]

[1.24.3]

• Update vaultwarden to 1.35.4
• Full Changelog
• GHSA-w9f8-m526-h7fh. This vulnerability would allow an attacker to access a cipher from a different user (fully encrypted) if they already know its internal UUID.
• GHSA-h4hq-rgvh-wh27. This vulnerability allows an attacker with manager-level access within an organization to modify collections they can access, even if they do not have management permissions for them.
• GHSA-r32r-j5jq-3w4m. This vulnerability allows an attacker with manager-level access within an organization to modify collections they are not assigned.
• Update Rust and Crates and GHA by @​BlackDex in #​6843
• hide remember 2fa token by @​stefan0xC in #​6852
• fix(send_invite): invite links by @​proofofcopilot in #​6824
• Misc organization fixes by @​BlackDex in #​6867

[Package Updates]

[1.24.4]

• Update vaultwarden to 1.35.8
• Full Changelog
• Dummy org Master password policy auth fix by @Timshel in #7097
• Fix recovery-code not working by @BlackDex in #7102
• Fix invalid refresh token response by @BlackDex in #7105
• Fix 2FA for Android by @BlackDex in #7093
• Fix MFA Remember by @BlackDex in #7085
• GHSA-937x-3j8m-7w7p Unconfirmed Owner Can Purge Entire Organization Vault.
• GHSA-569v-845w-g82p Cross-Org Group Binding Enables Unauthorized Read And Write Access Into Another Organization
• GHSA-6j4w-g4jh-xjfx Refresh tokens not invalidated on security stamp rotation
• Two Factor Remember Tokens are now valid for max 30 days. Old tokens are invalid directly after upgrading.
• Rotate refresh-tokens on sstamp reset by @BlackDex in #7031

[Package Updates]

[1.25.0]

• Update vaultwarden to 1.36.0
• Full Changelog
• SSO Login CSRF GHSA-pfp2-jhgq-6hg5 GHSA-w6h6-8r66-hcv7
• User/Organization Enumeration GHSA-hxqh-ff5p-wfr3
• SSO existing-user binding GHSA-j4j8-gpvj-7fqr GHSA-6x5c-84vm-5j56
• SSRF via Icon Endpoint GHSA-72vh-x5jq-m82g
• Archiving of items is available https://bitwarden.com/blog/keep-your-vault-tidy-with-item-archiving/ https://bitwarden.com/nl-nl/help/managing-items/#archive
• Web Vault updated to v2026.4.1
• SSO fallback to UserInfo preferred_username by @Timshel in #7128
• Add support for archiving items by @matt-aaron in #6916
• Fix favicon fetching to check all icon links instead of just the first one by @Shocker in #6880
• fix: return Err instead of panic on unknown cipher atype in to_json() by @mango766 in #7068

[Package Updates]

[1.26.0]

• Update vaultwarden to 1.37.0
• Full Changelog
• SSRF via the icon endpoint [GHSA-hw4g-2v3f-74x5] [GHSA-vh5m-fc9v-m84g] (Medium, 5.8 / 6.3)
• Cross-Organization Cipher Access [GHSA-xwf8-pjh7-h589] (Medium, 5.9)
• Organization Policy Bypass on Directory Import [GHSA-88qc-6ch9-mc3j] (Medium, 5.5)
• Send Access-Count Bypass [GHSA-rxhg-2pw9-vf25] (Medium, 5.3)
• Unauthenticated WebSocket Flooding DDOS [GHSA-96f7-78q5-j345] (Medium, 5.3)
• OpenDAL S3 parameter support by @txase in #6127
• Reject unrecognised DATABASE_URL instead of silent SQLite fallback by @mfw78 in #7061
• Trusted proxy support, unauthenticated rate limit & other fixes by @dani-garcia in #7472
• Fix SSO Cookie path by @BlackDex in #7187
• fix email 2fa for bw cli by @stefan0xC in #7225

[Package Updates]

[1.26.1]

• Update vaultwarden to 1.37.1
• Full Changelog
• Always send initOrganization and orgUserHasExistingUser in invite URL by @vikfox in #7482
• Indirectly resolved #7475 by using newer rust-musl build images which had a compilation issue with OpenSSL.

[Package Updates]

[1.26.2]

• Update vaultwarden to 1.37.2
• Full Changelog
• This update is required for support with clients with version 2026.8.0+, please update before reporting any issues with them.
• Fix Debian cross-linking with xx-cargo by @alexliluz in #7524
• Fix playwright test by @Timshel in #7548
• Misc fixes and updates by @BlackDex in #7558
• Include user email in successful login logs by @lmogthb in #7496
• Fix sendmail executable permission check by @p-boenisch in #7483
• add dummy revisionDate by @stefan0xC in #7608

[Package Updates]

[1.26.3]

• Update vaultwarden to 1.37.3
• Full Changelog
• Fix password change with newer web-vault by @BlackDex in #7634
• Ignore reset-password auto-enroll when mail is disabled by @xhon-pelushi in #7585
• Fix migration for MariaDB 12.2.2 by @Timshel in #7265
• Add SSO_SIGNUPS_ALLOWED by @Timshel in #7272
• Fix organization import failing with missing field groups by @tom27052006 in #7699
• Add pm-32413-multi-client-password-management feature flag by @tom27052006 in #7677
• Log IP/username on two-factor email-login credential failures by @crahn in #7654
• Support admin reset 2fa by @Timshel in #7435
• fix(security): revoke 2FA remember tokens when credentials or 2FA change by @BryanFRD in #7682
• fix(security): rate limit prelogin and auth request endpoints by @BryanFRD in #7681