Vaultwarden 1.35.5 Security Advisory: Fixes for GHSA-937x/569v/64bw Org Privilege Escalation and Token Invalidation

Vulnerability Overview Vaultwarden version 1.35.5 includes the following security fixes: 1. GHSA-937x-3j8m-7w7p: Unconfirmed owners can clear the entire organization Vault. 2. GHSA-569v-845w-82jp: Cross-organization group binding allows unauthorized reading and writing to another organization. 3. GHSA-64bw-q4jh-xjfx: Refresh tokens are not invalidated during security stamp rotation. Scope of Impact GHSA-937x-3j8m-7w7p: Affects all scenarios where owners can clear the entire organization Vault. GHSA-569v-845w-82jp: Affects cross-organization group binding, potentially leading to unauthorized data access. GHSA-64bw-q4jh-xjfx: Affects users utilizing refresh tokens, particularly during security stamp rotation. Remediation It is strongly recommended to update to Vaultwarden version 1.35.5 as soon as possible to address the aforementioned security issues. After updating, ensure that management templates are also updated, especially if these settings are overridden via templates. Note: Two-factor remember tokens are now valid for a maximum of 30 days; old tokens will immediately expire after the upgrade. Other Changes Application policies now apply only to confirmed members. Added Safari account switching functionality. Added to API key login. Added WebAuthn-related origin flags. Added a 30-second cache to . Added and feature flags. Support for new desktop origin CORS. Fixed checkout operation version. Fixed API key login. Fixed Base64 padding in email headers. Updated feature flags. Updated crates and GHA. Used protected CI environments. Fixed 2FA "remember me" to actually last 30 days. Switched to operation. Rotate refresh tokens during reset. Fixed organization fixes. Fixed empty string . Disabled deployment to release environment. Fixed sending icons. Prevented managers from creating collections. Changed SQLite backup to use query. Handled and shutdown signals. Do not display unavailable 2FA options. Fixed log push identifiers and sent logout before clearing devices. Fixed Windows build issues. Updated crates and GHA. New Contributors @DerPlayer2001 @montdidier @pasarenicu @phoeagon @getaaron @0x484558 @qaz741wsd856 @Idontneedonetho Full Changelog 1.35.4 1.35.5 Contributors Timsel stefan0xC 11 other contributors Assets No specific asset information. Discussion 70 reactions. --- The above is a summary of the security fixes and other changes in Vaultwarden version 1.35.5.

Goal Reached Thanks to every supporter — we hit 100%!

Vaultwarden 1.35.5 Security Advisory: Fixes for GHSA-937x/569v/64bw Org Privilege Escalation and Token Invalidation

More from this source