[PR #7031] [MERGED] Rotate refresh-tokens on sstamp reset #12763

New Issue

Closed

opened 2026-04-20 15:59:03 -05:00 by GiteaMirror · 0 comments

GiteaMirror commented 2026-04-20 15:59:03 -05:00

Owner

Copy Link

Copy Source

📋 Pull Request Information

Original PR: https://github.com/dani-garcia/vaultwarden/pull/7031
Author: @BlackDex
Created: 3/29/2026
Status: ✅ Merged
Merged: 3/29/2026
Merged by: @dani-garcia

Base: main ← Head: login-fixes

---

📝 Commits (1)

• 9caedb8 Rotate refresh-tokens on sstamp reset

📊 Changes

6 files changed (+46 additions, -17 deletions)

View changed files

📝 src/api/admin.rs (+2 -2)
📝 src/api/core/accounts.rs (+16 -8)
📝 src/api/core/emergency_access.rs (+1 -1)
📝 src/api/core/organizations.rs (+2 -1)
📝 src/db/models/device.rs (+17 -1)
📝 src/db/models/user.rs (+8 -4)

📄 Description

When a security-stamp gets reset/rotated we should also rotate all device refresh-tokens to invalidate them. Else clients are still able to use old refresh tokens.

---

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/dani-garcia/vaultwarden/pull/7031 **Author:** [@BlackDex](https://github.com/BlackDex) **Created:** 3/29/2026 **Status:** ✅ Merged **Merged:** 3/29/2026 **Merged by:** [@dani-garcia](https://github.com/dani-garcia) **Base:** `main` ← **Head:** `login-fixes` --- ### 📝 Commits (1) - [`9caedb8`](https://github.com/dani-garcia/vaultwarden/commit/9caedb8c8a42782b47730a58266ff8d1ff125e8a) Rotate refresh-tokens on sstamp reset ### 📊 Changes **6 files changed** (+46 additions, -17 deletions) <details> <summary>View changed files</summary> 📝 `src/api/admin.rs` (+2 -2) 📝 `src/api/core/accounts.rs` (+16 -8) 📝 `src/api/core/emergency_access.rs` (+1 -1) 📝 `src/api/core/organizations.rs` (+2 -1) 📝 `src/db/models/device.rs` (+17 -1) 📝 `src/db/models/user.rs` (+8 -4) </details> ### 📄 Description When a security-stamp gets reset/rotated we should also rotate all device refresh-tokens to invalidate them. Else clients are still able to use old refresh tokens. --- _{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

GiteaMirror added the pull-request label 2026-04-20 15:59:03 -05:00

GiteaMirror closed this issue 2026-04-20 15:59:03 -05:00

Sign in to join this conversation.

No Branch/Tag Specified

Branches Tags

main

v2-registration

revert-7033-patch-1

cached-config-operations

test_dylint

1.37.2

1.37.1

1.37.0

1.36.0

1.35.8

1.35.7

1.35.6

1.35.5

1.35.4

1.35.3

1.35.2

1.35.1

1.35.0

1.34.3

1.34.2

1.34.1

1.34.0

1.33.2

1.33.1

1.33.0

1.32.7

1.32.6

1.32.5

1.32.4

1.32.3

1.32.2

1.32.1

1.32.0

1.31.0

1.30.5

1.30.4

1.30.3

1.30.2

1.30.1

1.30.0

1.29.2

1.29.1

1.29.0

1.28.1

1.28.0

1.27.0

1.26.0

1.25.2

1.25.1

1.25.0

1.24.0

1.23.1

1.23.0

1.22.2

1.22.1

1.22.0

1.21.0

1.20.0

1.19.0

1.18.0

1.17.0

1.16.3

1.16.2

1.16.1

1.16.0

1.15.1

1.15.0

1.14.2

1.14.1

1.14

1.13.1

1.13.0

1.12.0

1.11.0

1.10.0

1.9.1

1.9.0

1.8.0

1.7.0

1.6.1

1.6.0

1.5.0

1.4.0

1.3.0

1.2.0

1.1.0

1.0.0

0.13.0

0.12.0

0.11.0

0.10.0

0.9.0

Labels

Clear labels

better for forum

bug

documentation

duplicate

enhancement

future Vault

good first issue

help wanted

low priority

notes

pull-request

Mirrored from GitHub Pull Request

question

SSO

Third party

troubleshooting

wontfix

No labels pull-request

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

GiteaMirror ninjasurge (Kaehlen Rog)

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/vaultwarden#12763