Disclaimer: Automated heuristics over public release notes and vulnerability databases (OSV / NVD). Can be wrong or incomplete. Always back up first and validate upgrades yourself. Stack Watch does not invent CVE IDs or issue counts. This is an MVP research project, not a live paid service.

Home / Vaultwarden / 1.37.3

Vaultwarden 1.37.3

UPDATE_WITH_CARE

Security-related language in release notes; update after a backup if you are affected.

Published: 2026-09-13T15:03:37Z · GitHub release

Summary of changes

## What's Changed - Fix password change with newer web-vault by @BlackDex in #7634 - chore: remove duplicate "the" in ciphers.rs comment by @mvanhorn in #7254 - Ignore reset-password auto-enroll when mail is disabled by @xhon-pelushi in #7585 - Fix migration for MariaDB 12.2.2 by @Timshel in #7265 - Add SSO_SIGNUPS_ALLOWED by @Timshel in #7272 - log_event take enum parameter not i32 by @Timshel in #7656 - Misc Updates by @BlackDex in #7676 - Update rust docker version by @dani-garcia in #7689 - Fix organization import failing with missing field groups by @tom27052006 in #7699 - Add pm-32413-multi-client-password-management feature flag by @tom27052006 in #7677 - Log IP/username on two-factor email-login credential failures by @crahn in #7654 - Support admin reset 2fa by @Timshel in #7435 - fix(security): revoke 2FA remember tokens when credentials or 2FA change by @BryanFRD in #7682 …

Breaking changes

None detected by heuristics.

CVEs linked to this release

None linked from release notes or OSV fixed-in match.

Linked issues / PRs mentioned

Back up first

Always back up first. Stack Watch briefs are automated heuristics over public release notes and vulnerability databases. They can be wrong or incomplete. You are responsible for validating upgrades in your own environment. We never invent CVE IDs or issue counts — if a number is missing, it was not found.