12 releases 12 tags

RSS feed

• v1.36.11 c86f861af4

  Compare

  Vaultwarden-Plus v1.36.11 Stable

  StefanSA released this 2026-07-30 12:50:27 +02:00 | 0 commits to main since this release

  Vaultwarden-Plus v1.36.11

  Release date: 2026-07-30

  Status: PASS

  Highlights

  • Completes production Device Login through the official durable /api/auth-requests flow and standard /identity/connect/token password grant with authRequest.
  • Guarantees atomic, single-use AuthRequest redemption across SQLite, MySQL/MariaDB, and PostgreSQL without a new migration.
  • Removes the obsolete non-token-issuing Device Login prototype and Web Vault approver adapter after native Web Vault 2026.6.4 end-to-end proof.

  Security Model

  • Redemption fails closed unless user, access code, request device identifier, device type, normalized client IP, approval, expiry, and unused state all match.
  • An atomic approved -> redeeming update permits exactly one token-generation attempt; parallel and replay attempts fail.
  • Successful token completion records redeemed; failed token or two-factor completion returns only the same bound request to approved.
  • Disabled-user, email-verification, two-factor, policy, audit, device, session, refresh-token, and login-rate-limit behavior remains on the standard password-login path.
  • TDAUTH-V2, Trusted Device auto-enrollment, Recovery, Passkey/PRF, Send OTP, SES, DKIM, and branding behavior is unchanged.

  Web Vault And Adapters

  • Native Web Vault 2026.6.4 passes Request, Poll, Approval, Response, Token, Sync, Refresh, and vault access without the Plus approver adapter.
  • The in-memory Device Login prototype routes and DEVICE_LOGIN_PROTOTYPE_ENABLED integration are removed.
  • The branding adapter remains packaged; the Account Recovery adapter remains absent where native handling applies.
  • No Web Vault, dependency, grant-type, token-format, or migration change is included.

  Validation

  • cargo fmt --check and git diff --check pass.
  • The full unfiltered locked Rust suite passes in forgejo-rust-node:1.97.1: 238 passed.
  • Locked SQLite, MySQL/MariaDB, PostgreSQL, and sqlite,ses checks pass.
  • Focused API coverage passes for success, rejection, expiry, wrong user/code/device/type/IP, replay, parallel redemption, and failed-token/TOTP recovery.
  • Native two-context HTTPS Device Login passes without the approver adapter, including token issue, sync, refresh, repeated sync, and vault access.
  • Focused browser coverage passes for account creation, TOTP activation/login/deactivation, Send Email OTP/Sends, and Organization invitation/confirmation with deterministic multi-account session isolation.
  • Recovery E2E, Web Vault packaging, container build, cache reuse, and runtime health remain green from the same unchanged product state.

  Image

  • forgejo.sabolowitsch.org/stefansa/vaultwarden-plus:1.36.11
  • forgejo.sabolowitsch.org/stefansa/vaultwarden-plus:latest

  Migration

  • Database migration: NO
  • Configuration migration: NO
  • Product behavior change: YES; Device Login now issues standard Access-/Refresh-Token sessions through the official AuthRequest flow.

  Residual Risks

  • The separate TDAUTH-V2 trusted-device auto-enrollment/dedicated-redemption track remains prototype-gated.
  • Device Login browser proof covers official Web Vault 2026.6.4; desktop and mobile end-to-end coverage remains outside this release.
  • The multi-account Organization browser test requires an extended local timeout because Web Vault performs several native KDF operations sequentially.

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads