Release 1.37.0 · dani-garcia/vaultwarden
github.com
Note This update is required for support with clients with version 2026.7.0+, please update before reporting any issues with them. Security Fixes This release contains security fixes for the follow...

If you got the automatic updates on the bitwarden clients, they will show an empty vault if you are selfhosting vaultwarden.

It seems to be an accidental bug in the bitwarden clients that are assuming that they’re talking with official servers

It’s fixed with the latest release of the vaultwarden server that was published a few minutes ago

  • SmoothLiquidation@lemmy.worldEnglish
    71·
    19 hours ago

    I found this comment on what happened by dani-garcia, one of the main devs:

    The short version is that around 8-ish years ago, Bitwarden changed the way the vault items were structured, and Vaultwarden added some backwards compatibility fields to ensure both old and new versions of the clients worked.

    These backwards compatibility fields were supposed to be a temporary measure, but for at least the next three years the clients still required them, until we eventually forgot to keep track of them. At some point between 2021 and today, the clients stopped requiring these backwards compatibility fields, but Vaultwarden was still sending them.

    This wasn’t a problem until Bitwarden decided to use the backwards compatibility fields in a completely different way, which caused the clients to crash.

    Found here: https://github.com/dani-garcia/vaultwarden/discussions/7473

    • JordanZ@lemmy.worldEnglish
      31·
      10 hours ago

      There’s a reason you don’t do things like that…

      Apparently nobody in that software team has heard about Knight Capital. They reused a flag and that coupled with a deployment failure that only lasted ~45 minutes caused an over 400 million dollar loss nearly bankrupting the entire company. Ultimately they ended up combining with another company.

      The immediate cause of the incident was a deployment failure that left one of eight servers running outdated code, creating an inconsistency in how the system interpreted incoming instructions. The new software reused a flag associated with a legacy function known as “Power Peg,” which had been disabled but not removed from the codebase, and on the unpatched server this flag activated obsolete logic that continuously generated child orders in response to parent orders that the system did not correctly recognize as already filled.

      More details