Account Recovery

Overview

Vaultwarden-Plus v1.36.3 includes Web Vault 2026.4.1-compatible Organization Account Recovery for enrolled organization members. Validated coverage includes Admin Recover Account, forced password reset, PUT /accounts/update-temp-password, legacy and V2 recovery payloads, and 2FA-only recovery requests.

Requirements

• Vaultwarden-Plus v1.36.3.
• Bundled Web Vault 2026.4.1.
• Organization policy and member enrollment.
• Authorized organization administrator action.
• Working SMTP, sendmail, or SES mail delivery for recovery notifications.

Configuration

Account Recovery does not document a standalone feature flag in the current canonical docs. It depends on the validated release behavior, organization recovery policy/enrollment, and a working mail transport.

Mail transport examples:

SMTP_HOST=smtp.example.org
SMTP_FROM=vaultwarden@example.org
SMTP_PORT=587
SMTP_SECURITY=starttls

For SES-backed delivery, see SMTP Configuration.

Examples

Validated flow:

1. Organization policy and enrollment make the Recover Account menu visible.
2. Admin Recover Account completes through the Web Vault.
3. The member enters forced password-reset state on login.
4. The member completes recovery through PUT /accounts/update-temp-password.

Troubleshooting

• If recovery notification mail does not arrive, verify SMTP, sendmail, or SES first.
• Provider-specific behavior, custom role manageResetPassword parity, and Key Connector behavior are not claimed in the current release.
• Keep Web Vault on the validated 2026.4.1 bundle until a newer accepted artifact is separately validated.
• Do not log or publish recovery links, recovery material, encrypted keys, passwords, OTP values, or tokens.

Related Pages

• SMTP Configuration
• Release & Upgrade Guide
• Troubleshooting

Canonical Documentation

• Features: Organization Account Recovery
• Known Limitations: Account Recovery
• v1.36.3 Release Notes