github-starred/vaultwarden
2
0
Fork 0
mirror of https://github.com/dani-garcia/vaultwarden.git synced 2026-08-24 23:22:58 -05:00
Code Issues 534 Packages Projects Releases 86 Wiki Activity

[GH-ISSUE #6407] Encryption Key Rotation fails #35373

New Issue
Closed
opened 2026-07-13 20:10:59 -05:00 by GiteaMirror · 19 comments
GiteaMirror commented 2026-07-13 20:10:59 -05:00
Owner
Copy Link
Copy Source

Originally created by @PedroDuarteMesquitaPinto-ops on GitHub (Oct 28, 2025).
Original GitHub issue: https://github.com/dani-garcia/vaultwarden/issues/6407

Prerequisites

Vaultwarden Support String

Your environment (Generated via diagnostics page)

  • Vaultwarden version: v1.34.3-a85b4851
  • Web-vault version: v2025.9.1
  • OS/Arch: linux/x86_64
  • Running within a container: false (Base: Not applicable)
  • Database type: PostgreSQL
  • Database version: PostgreSQL 16.10 on x86_64-pc-linux-gnu, compiled by gcc (GCC) 11.2.0, 64-bit
  • Uses config.json: false
  • Uses a reverse proxy: true
  • IP Header check: true (X-Forwarded-For)
  • Internet access: true
  • Internet access via a proxy: false
  • DNS Check: true
  • Browser/Server Time Check: true
  • Server/NTP Time Check: true
  • Domain Configuration Check: false
  • HTTPS Check: true
  • Websocket Check: true
  • HTTP Response Checks: true

Config & Details (Generated via diagnostics page)

Show Config & Details

Config:

{
  "_duo_akey": null,
  "_enable_duo": false,
  "_enable_email_2fa": false,
  "_enable_smtp": true,
  "_enable_yubico": false,
  "_icon_service_csp": "",
  "_icon_service_url": "",
  "_ip_header_enabled": true,
  "_max_note_size": 10000,
  "_smtp_img_src": "***:",
  "admin_ratelimit_max_burst": 3,
  "admin_ratelimit_seconds": 300,
  "admin_session_lifetime": 20,
  "admin_token": "***",
  "allowed_connect_src": "",
  "allowed_iframe_ancestors": "",
  "attachments_folder": "data/attachments",
  "auth_request_purge_schedule": "30 * * * * *",
  "authenticator_disable_time_drift": false,
  "data_folder": "data",
  "database_conn_init": "",
  "database_idle_timeout": 600,
  "database_max_conns": 10,
  "database_min_conns": 2,
  "database_timeout": 30,
  "database_url": "**********://**********************************************************************************************************",
  "db_connection_retries": 15,
  "disable_2fa_remember": false,
  "disable_admin_token": false,
  "disable_icon_download": false,
  "domain": "*****://***************",
  "domain_origin": "*****://***************",
  "domain_path": "",
  "domain_set": true,
  "duo_context_purge_schedule": "30 * * * * *",
  "duo_host": null,
  "duo_ikey": null,
  "duo_skey": null,
  "duo_use_iframe": false,
  "email_2fa_auto_fallback": false,
  "email_2fa_enforce_on_verified_invite": false,
  "email_attempts_limit": 3,
  "email_change_allowed": false,
  "email_expiration_time": 600,
  "email_token_size": 6,
  "emergency_access_allowed": false,
  "emergency_notification_reminder_schedule": "0 3 * * * *",
  "emergency_request_timeout_schedule": "0 7 * * * *",
  "enable_db_wal": true,
  "enable_websocket": true,
  "enforce_single_org_with_reset_pw_policy": false,
  "event_cleanup_schedule": "0 10 0 * * *",
  "events_days_retain": null,
  "experimental_client_feature_flags": "",
  "extended_logging": true,
  "helo_name": null,
  "hibp_api_key": null,
  "http_request_block_non_global_ips": true,
  "http_request_block_regex": null,
  "icon_blacklist_non_global_ips": true,
  "icon_blacklist_regex": null,
  "icon_cache_folder": "data/icon_cache",
  "icon_cache_negttl": 259200,
  "icon_cache_ttl": 2592000,
  "icon_download_timeout": 10,
  "icon_redirect_code": 302,
  "icon_service": "internal",
  "incomplete_2fa_schedule": "30 * * * * *",
  "incomplete_2fa_time_limit": 3,
  "increase_note_size_limit": false,
  "invitation_expiration_hours": 120,
  "invitation_org_name": "BVGroup",
  "invitations_allowed": false,
  "ip_header": "X-Forwarded-For",
  "job_poll_interval_ms": 30000,
  "log_file": null,
  "log_level": "info",
  "log_timestamp_format": "%Y-%m-%d %H:%M:%S.%3f",
  "login_ratelimit_max_burst": 10,
  "login_ratelimit_seconds": 60,
  "org_attachment_limit": null,
  "org_creation_users": "",
  "org_events_enabled": false,
  "org_groups_enabled": false,
  "password_hints_allowed": true,
  "password_iterations": 600000,
  "purge_incomplete_sso_nonce": "0 20 0 * * *",
  "push_enabled": false,
  "push_identity_uri": "https://identity.bitwarden.com",
  "push_installation_id": "***",
  "push_installation_key": "***",
  "push_relay_uri": "https://push.bitwarden.com",
  "reload_templates": false,
  "require_device_email": false,
  "rsa_key_filename": "data/rsa_key",
  "send_purge_schedule": "0 5 * * * *",
  "sendmail_command": null,
  "sends_allowed": false,
  "sends_folder": "data/sends",
  "show_password_hint": false,
  "signups_allowed": true,
  "signups_domains_whitelist": "",
  "signups_verify": false,
  "signups_verify_resend_limit": 6,
  "signups_verify_resend_time": 3600,
  "smtp_accept_invalid_certs": false,
  "smtp_accept_invalid_hostnames": false,
  "smtp_auth_mechanism": "Login",
  "smtp_debug": false,
  "smtp_embed_images": true,
  "smtp_explicit_tls": null,
  "smtp_from": "*****************************",
  "smtp_from_name": "Vaultwarden",
  "smtp_host": "**********************",
  "smtp_password": "***",
  "smtp_port": 587,
  "smtp_security": "starttls",
  "smtp_ssl": null,
  "smtp_timeout": 15,
  "smtp_username": "***************",
  "sso_allow_unknown_email_verification": true,
  "sso_audience_trusted": null,
  "sso_auth_only_not_session": false,
  "sso_authority": "*****://*******************************************************************",
  "sso_authorize_extra_params": "",
  "sso_callback_path": "*****://********************************************",
  "sso_client_cache_expiration": 0,
  "sso_client_id": "************************************",
  "sso_client_secret": "***",
  "sso_debug_tokens": false,
  "sso_enabled": true,
  "sso_master_password_policy": null,
  "sso_only": true,
  "sso_pkce": true,
  "sso_scopes": "openid profile offline_access User.Read",
  "sso_signups_match_email": true,
  "templates_folder": "data/templates",
  "tmp_folder": "data/tmp",
  "trash_auto_delete_days": null,
  "trash_purge_schedule": "0 5 0 * * *",
  "use_sendmail": false,
  "use_syslog": false,
  "user_attachment_limit": null,
  "user_send_limit": null,
  "web_vault_enabled": true,
  "web_vault_folder": "web-vault/",
  "yubico_client_id": null,
  "yubico_secret_key": null,
  "yubico_server": null
}

Vaultwarden Build Version

testing sha256-caae61cf1a6d2ddf07a8aee771c69fe2498427bcb49cbf44dd9bfad297b80694

Deployment method

Official Container Image

Custom deployment method

No response

Reverse Proxy

Azure Container App Ingress

Host/Server Operating System

Cloud

Operating System Version

No response

Clients

Web Vault

Client Version

testing sha256-caae61cf1a6d2ddf07a8aee771c69fe2498427bcb49cbf44dd9bfad297b80694

Steps To Reproduce

Select "Also rotate my account's encryption key" when changing master password.

Expected Result

The master password to be changed along with the account's encryption key.

Actual Result

It fails with "An error has occurred."

Logs

2025-10-28T13:21:24.176212643Z [2025-10-28 13:21:24.176][request][INFO] POST /identity/connect/token
2025-10-28T13:21:24.461438072Z [2025-10-28 13:21:24.461][response][INFO] (login) POST /identity/connect/token => 200 OK
2025-10-28T13:21:24.504075579Z [2025-10-28 13:21:24.503][request][INFO] GET /api/sync?excludeDomains=true
2025-10-28T13:21:24.526132745Z [2025-10-28 13:21:24.526][response][INFO] (sync) GET /api/sync?<data..> => 200 OK
2025-10-28T13:21:24.619289289Z [2025-10-28 13:21:24.619][request][INFO] GET /api/emergency-access/trusted
2025-10-28T13:21:24.624348173Z [2025-10-28 13:21:24.624][response][INFO] (get_contacts) GET /api/emergency-access/trusted => 200 OK
2025-10-28T13:21:24.664830244Z [2025-10-28 13:21:24.664][request][INFO] GET /api/users/public-key
2025-10-28T13:21:24.664923146Z [2025-10-28 13:21:24.664][response][INFO] (web_files) GET /<p..> [10] => 404 Not Found

Screenshots or Videos

Image

Additional Context

No response

Originally created by @PedroDuarteMesquitaPinto-ops on GitHub (Oct 28, 2025). Original GitHub issue: https://github.com/dani-garcia/vaultwarden/issues/6407 ### Prerequisites - [x] I have searched the existing **Closed _AND_ Open** [Issues](https://github.com/dani-garcia/vaultwarden/issues?q=is%3Aissue%20) **_AND_** [Discussions](https://github.com/dani-garcia/vaultwarden/discussions?discussions_q=) - [x] I have searched and read the [documentation](https://github.com/dani-garcia/vaultwarden/wiki/) ### Vaultwarden Support String ### Your environment (Generated via diagnostics page) * Vaultwarden version: v1.34.3-a85b4851 * Web-vault version: v2025.9.1 * OS/Arch: linux/x86_64 * Running within a container: false (Base: Not applicable) * Database type: PostgreSQL * Database version: PostgreSQL 16.10 on x86_64-pc-linux-gnu, compiled by gcc (GCC) 11.2.0, 64-bit * Uses config.json: false * Uses a reverse proxy: true * IP Header check: true (X-Forwarded-For) * Internet access: true * Internet access via a proxy: false * DNS Check: true * Browser/Server Time Check: true * Server/NTP Time Check: true * Domain Configuration Check: false * HTTPS Check: true * Websocket Check: true * HTTP Response Checks: true ### Config & Details (Generated via diagnostics page) <details><summary>Show Config & Details</summary> **Config:** ```json { "_duo_akey": null, "_enable_duo": false, "_enable_email_2fa": false, "_enable_smtp": true, "_enable_yubico": false, "_icon_service_csp": "", "_icon_service_url": "", "_ip_header_enabled": true, "_max_note_size": 10000, "_smtp_img_src": "***:", "admin_ratelimit_max_burst": 3, "admin_ratelimit_seconds": 300, "admin_session_lifetime": 20, "admin_token": "***", "allowed_connect_src": "", "allowed_iframe_ancestors": "", "attachments_folder": "data/attachments", "auth_request_purge_schedule": "30 * * * * *", "authenticator_disable_time_drift": false, "data_folder": "data", "database_conn_init": "", "database_idle_timeout": 600, "database_max_conns": 10, "database_min_conns": 2, "database_timeout": 30, "database_url": "**********://**********************************************************************************************************", "db_connection_retries": 15, "disable_2fa_remember": false, "disable_admin_token": false, "disable_icon_download": false, "domain": "*****://***************", "domain_origin": "*****://***************", "domain_path": "", "domain_set": true, "duo_context_purge_schedule": "30 * * * * *", "duo_host": null, "duo_ikey": null, "duo_skey": null, "duo_use_iframe": false, "email_2fa_auto_fallback": false, "email_2fa_enforce_on_verified_invite": false, "email_attempts_limit": 3, "email_change_allowed": false, "email_expiration_time": 600, "email_token_size": 6, "emergency_access_allowed": false, "emergency_notification_reminder_schedule": "0 3 * * * *", "emergency_request_timeout_schedule": "0 7 * * * *", "enable_db_wal": true, "enable_websocket": true, "enforce_single_org_with_reset_pw_policy": false, "event_cleanup_schedule": "0 10 0 * * *", "events_days_retain": null, "experimental_client_feature_flags": "", "extended_logging": true, "helo_name": null, "hibp_api_key": null, "http_request_block_non_global_ips": true, "http_request_block_regex": null, "icon_blacklist_non_global_ips": true, "icon_blacklist_regex": null, "icon_cache_folder": "data/icon_cache", "icon_cache_negttl": 259200, "icon_cache_ttl": 2592000, "icon_download_timeout": 10, "icon_redirect_code": 302, "icon_service": "internal", "incomplete_2fa_schedule": "30 * * * * *", "incomplete_2fa_time_limit": 3, "increase_note_size_limit": false, "invitation_expiration_hours": 120, "invitation_org_name": "BVGroup", "invitations_allowed": false, "ip_header": "X-Forwarded-For", "job_poll_interval_ms": 30000, "log_file": null, "log_level": "info", "log_timestamp_format": "%Y-%m-%d %H:%M:%S.%3f", "login_ratelimit_max_burst": 10, "login_ratelimit_seconds": 60, "org_attachment_limit": null, "org_creation_users": "", "org_events_enabled": false, "org_groups_enabled": false, "password_hints_allowed": true, "password_iterations": 600000, "purge_incomplete_sso_nonce": "0 20 0 * * *", "push_enabled": false, "push_identity_uri": "https://identity.bitwarden.com", "push_installation_id": "***", "push_installation_key": "***", "push_relay_uri": "https://push.bitwarden.com", "reload_templates": false, "require_device_email": false, "rsa_key_filename": "data/rsa_key", "send_purge_schedule": "0 5 * * * *", "sendmail_command": null, "sends_allowed": false, "sends_folder": "data/sends", "show_password_hint": false, "signups_allowed": true, "signups_domains_whitelist": "", "signups_verify": false, "signups_verify_resend_limit": 6, "signups_verify_resend_time": 3600, "smtp_accept_invalid_certs": false, "smtp_accept_invalid_hostnames": false, "smtp_auth_mechanism": "Login", "smtp_debug": false, "smtp_embed_images": true, "smtp_explicit_tls": null, "smtp_from": "*****************************", "smtp_from_name": "Vaultwarden", "smtp_host": "**********************", "smtp_password": "***", "smtp_port": 587, "smtp_security": "starttls", "smtp_ssl": null, "smtp_timeout": 15, "smtp_username": "***************", "sso_allow_unknown_email_verification": true, "sso_audience_trusted": null, "sso_auth_only_not_session": false, "sso_authority": "*****://*******************************************************************", "sso_authorize_extra_params": "", "sso_callback_path": "*****://********************************************", "sso_client_cache_expiration": 0, "sso_client_id": "************************************", "sso_client_secret": "***", "sso_debug_tokens": false, "sso_enabled": true, "sso_master_password_policy": null, "sso_only": true, "sso_pkce": true, "sso_scopes": "openid profile offline_access User.Read", "sso_signups_match_email": true, "templates_folder": "data/templates", "tmp_folder": "data/tmp", "trash_auto_delete_days": null, "trash_purge_schedule": "0 5 0 * * *", "use_sendmail": false, "use_syslog": false, "user_attachment_limit": null, "user_send_limit": null, "web_vault_enabled": true, "web_vault_folder": "web-vault/", "yubico_client_id": null, "yubico_secret_key": null, "yubico_server": null } ``` </details> ### Vaultwarden Build Version testing sha256-caae61cf1a6d2ddf07a8aee771c69fe2498427bcb49cbf44dd9bfad297b80694 ### Deployment method Official Container Image ### Custom deployment method _No response_ ### Reverse Proxy Azure Container App Ingress ### Host/Server Operating System Cloud ### Operating System Version _No response_ ### Clients Web Vault ### Client Version testing sha256-caae61cf1a6d2ddf07a8aee771c69fe2498427bcb49cbf44dd9bfad297b80694 ### Steps To Reproduce Select "Also rotate my account's encryption key" when changing master password. ### Expected Result The master password to be changed along with the account's encryption key. ### Actual Result It fails with "An error has occurred." ### Logs ```text 2025-10-28T13:21:24.176212643Z [2025-10-28 13:21:24.176][request][INFO] POST /identity/connect/token 2025-10-28T13:21:24.461438072Z [2025-10-28 13:21:24.461][response][INFO] (login) POST /identity/connect/token => 200 OK 2025-10-28T13:21:24.504075579Z [2025-10-28 13:21:24.503][request][INFO] GET /api/sync?excludeDomains=true 2025-10-28T13:21:24.526132745Z [2025-10-28 13:21:24.526][response][INFO] (sync) GET /api/sync?<data..> => 200 OK 2025-10-28T13:21:24.619289289Z [2025-10-28 13:21:24.619][request][INFO] GET /api/emergency-access/trusted 2025-10-28T13:21:24.624348173Z [2025-10-28 13:21:24.624][response][INFO] (get_contacts) GET /api/emergency-access/trusted => 200 OK 2025-10-28T13:21:24.664830244Z [2025-10-28 13:21:24.664][request][INFO] GET /api/users/public-key 2025-10-28T13:21:24.664923146Z [2025-10-28 13:21:24.664][response][INFO] (web_files) GET /<p..> [10] => 404 Not Found ``` ### Screenshots or Videos <img width="436" height="97" alt="Image" src="https://github.com/user-attachments/assets/255495ce-fe3b-495e-9b9b-60157431b2f5" /> ### Additional Context _No response_
GiteaMirror added the bug label 2026-07-13 20:10:59 -05:00
GiteaMirror commented 2026-07-13 20:11:01 -05:00
Author
Owner
Copy Link
Copy Source

@BlackDex commented on GitHub (Oct 28, 2025):

Already resolved in the testing tagged images

<!-- gh-comment-id:3456642943 --> @BlackDex commented on GitHub (Oct 28, 2025): Already resolved in the `testing` tagged images
GiteaMirror commented 2026-07-13 20:11:01 -05:00
Author
Owner
Copy Link
Copy Source

@PedroDuarteMesquitaPinto-ops commented on GitHub (Oct 28, 2025):

@BlackDex the issue occurs with the latest testing image, please see the version above.

<!-- gh-comment-id:3456895326 --> @PedroDuarteMesquitaPinto-ops commented on GitHub (Oct 28, 2025): @BlackDex the issue occurs with the latest testing image, please see the version above.
GiteaMirror commented 2026-07-13 20:11:02 -05:00
Author
Owner
Copy Link
Copy Source

@BlackDex commented on GitHub (Nov 1, 2025):

I tested it my self, and it works just fine. There is only one bug, which i currently have solved, and that is when there is an invited user in the emergency-contact's which not yet is confirmed.

I'm also not seeing anything strange in the logs which could indicate an issue.
Are there any useful logs in the reverse proxy?

<!-- gh-comment-id:3476629215 --> @BlackDex commented on GitHub (Nov 1, 2025): I tested it my self, and it works just fine. There is only one bug, which i currently have solved, and that is when there is an invited user in the emergency-contact's which not yet is confirmed. I'm also not seeing anything strange in the logs which could indicate an issue. Are there any useful logs in the reverse proxy?
GiteaMirror commented 2026-07-13 20:11:03 -05:00
Author
Owner
Copy Link
Copy Source

@BlackDex commented on GitHub (Nov 10, 2025):

Closing this as not being able to reproduce. Please provide more logs if this still is an issue.
Also try the current latest version which has a newer version of the web-vault, and one specific item fixed with key-rotation, but not linked to this i think.

Please re-open with more logs if this still is causing issues.

<!-- gh-comment-id:3511292217 --> @BlackDex commented on GitHub (Nov 10, 2025): Closing this as not being able to reproduce. Please provide more logs if this still is an issue. Also try the current latest version which has a newer version of the web-vault, and one specific item fixed with key-rotation, but not linked to this i think. Please re-open with more logs if this still is causing issues.
GiteaMirror commented 2026-07-13 20:11:03 -05:00
Author
Owner
Copy Link
Copy Source

@PedroDuarteMesquitaPinto-ops commented on GitHub (Nov 10, 2025):

Tested with the latest testing image, the "404" comes from the container:

2025-11-10T15:15:48.191722960Z [2025-11-10 15:15:48.191][request][INFO] POST /identity/connect/token 2025-11-10T15:15:48.436869677Z [2025-11-10 15:15:48.436][response][INFO] (login) POST /identity/connect/token => 200 OK 2025-11-10T15:15:48.478619817Z [2025-11-10 15:15:48.478][request][INFO] GET /api/sync?excludeDomains=true 2025-11-10T15:15:48.508333116Z [2025-11-10 15:15:48.508][response][INFO] (sync) GET /api/sync?<data..> => 200 OK 2025-11-10T15:15:48.590454989Z [2025-11-10 15:15:48.590][request][INFO] GET /api/emergency-access/trusted 2025-11-10T15:15:48.593958601Z [2025-11-10 15:15:48.593][response][INFO] (get_contacts) GET /api/emergency-access/trusted => 200 OK 2025-11-10T15:15:48.634260435Z [2025-11-10 15:15:48.634][request][INFO] GET /api/users/public-key 2025-11-10T15:15:48.634400736Z [2025-11-10 15:15:48.634][response][INFO] (web_files) GET /<p..> [10] => 404 Not Found

Versions

Server Installed Ok
    1.34.3-9017ca26 
Server Latest
    1.34.3-9017ca26 
Web Installed Pre-Release
    2025.10.1 
Web Latest
    2025.7.0 
Database
    PostgreSQL: PostgreSQL 16.10 on x86_64-pc-linux-gnu, compiled by gcc (GCC) 11.2.0, 64-bit
<!-- gh-comment-id:3512392389 --> @PedroDuarteMesquitaPinto-ops commented on GitHub (Nov 10, 2025): Tested with the latest testing image, the "404" comes from the container: `2025-11-10T15:15:48.191722960Z [2025-11-10 15:15:48.191][request][INFO] POST /identity/connect/token 2025-11-10T15:15:48.436869677Z [2025-11-10 15:15:48.436][response][INFO] (login) POST /identity/connect/token => 200 OK 2025-11-10T15:15:48.478619817Z [2025-11-10 15:15:48.478][request][INFO] GET /api/sync?excludeDomains=true 2025-11-10T15:15:48.508333116Z [2025-11-10 15:15:48.508][response][INFO] (sync) GET /api/sync?<data..> => 200 OK 2025-11-10T15:15:48.590454989Z [2025-11-10 15:15:48.590][request][INFO] GET /api/emergency-access/trusted 2025-11-10T15:15:48.593958601Z [2025-11-10 15:15:48.593][response][INFO] (get_contacts) GET /api/emergency-access/trusted => 200 OK 2025-11-10T15:15:48.634260435Z [2025-11-10 15:15:48.634][request][INFO] GET /api/users/public-key 2025-11-10T15:15:48.634400736Z [2025-11-10 15:15:48.634][response][INFO] (web_files) GET /<p..> [10] => 404 Not Found` ``` Versions Server Installed Ok 1.34.3-9017ca26 Server Latest 1.34.3-9017ca26 Web Installed Pre-Release 2025.10.1 Web Latest 2025.7.0 Database PostgreSQL: PostgreSQL 16.10 on x86_64-pc-linux-gnu, compiled by gcc (GCC) 11.2.0, 64-bit ```
GiteaMirror commented 2026-07-13 20:11:04 -05:00
Author
Owner
Copy Link
Copy Source

@stefan0xC commented on GitHub (Nov 10, 2025):

[2025-11-10 15:15:48.634][request][INFO] GET /api/users/public-key

Did your web-vault really request that path or did you change that in the log? Because /api/users/<user_id>/public-key should exist. That endpoint returns a 404 in one of these cases: https://github.com/dani-garcia/vaultwarden/blob/f9751a0a1dd69d082478283cf1d402ed91fe5bb7/src/api/core/accounts.rs#L469-L475

Can you check your database if the user account of your emergency access is valid / still exists? (If you deleted that user manually you would need to remove them also from your emergency access table...)

<!-- gh-comment-id:3513102287 --> @stefan0xC commented on GitHub (Nov 10, 2025): ``` [2025-11-10 15:15:48.634][request][INFO] GET /api/users/public-key ``` Did your web-vault really request that path or did you change that in the log? Because `/api/users/<user_id>/public-key` should exist. That endpoint returns a 404 in one of these cases: https://github.com/dani-garcia/vaultwarden/blob/f9751a0a1dd69d082478283cf1d402ed91fe5bb7/src/api/core/accounts.rs#L469-L475 Can you check your database if the user account of your emergency access is valid / still exists? (If you deleted that user manually you would need to remove them also from your emergency access table...)
GiteaMirror commented 2026-07-13 20:11:04 -05:00
Author
Owner
Copy Link
Copy Source

@PedroDuarteMesquitaPinto-ops commented on GitHub (Nov 11, 2025):

Did not change the logs, they are all a direct copy paste.

Looking atm at the database, will update soon.

The emergency access option is not available with the SSO configuration in place as above:

"sso_allow_unknown_email_verification": true,
"sso_audience_trusted": null,
"sso_auth_only_not_session": false,
"sso_authority": "://*******************************************************************",
"sso_authorize_extra_params": "",
"sso_callback_path": "://*****",
"sso_client_cache_expiration": 0,
"sso_client_id": "",
"sso_client_secret": "",
"sso_debug_tokens": false,
"sso_enabled": true,
"sso_master_password_policy": null,
"sso_only": true,
"sso_pkce": true,
"sso_scopes": "openid profile offline_access User.Read",
"sso_signups_match_email": true,

Image
<!-- gh-comment-id:3516014376 --> @PedroDuarteMesquitaPinto-ops commented on GitHub (Nov 11, 2025): Did not change the logs, they are all a direct copy paste. Looking atm at the database, will update soon. The emergency access option is not available with the SSO configuration in place as above: > "sso_allow_unknown_email_verification": true, > "sso_audience_trusted": null, > "sso_auth_only_not_session": false, > "sso_authority": "*****://*******************************************************************", > "sso_authorize_extra_params": "", > "sso_callback_path": "*****://********************************************", > "sso_client_cache_expiration": 0, > "sso_client_id": "************************************", > "sso_client_secret": "***", > "sso_debug_tokens": false, > "sso_enabled": true, > "sso_master_password_policy": null, > "sso_only": true, > "sso_pkce": true, > "sso_scopes": "openid profile offline_access User.Read", > "sso_signups_match_email": true, <img width="297" height="1252" alt="Image" src="https://github.com/user-attachments/assets/41f720fc-3187-4ed3-b9a7-174446733777" />
GiteaMirror commented 2026-07-13 20:11:05 -05:00
Author
Owner
Copy Link
Copy Source

@PedroDuarteMesquitaPinto-ops commented on GitHub (Nov 11, 2025):

vaultwarden=> select * from emergency_access;
 uuid | grantor_uuid | grantee_uuid | email | key_encrypted | atype | status | wait_time_days | recovery_initiated_at | last_notification_at | updated_at | created_at 
------+--------------+--------------+-------+---------------+-------+--------+----------------+-----------------------+----------------------+------------+------------
(0 rows)
<!-- gh-comment-id:3517895754 --> @PedroDuarteMesquitaPinto-ops commented on GitHub (Nov 11, 2025): ``` vaultwarden=> select * from emergency_access; uuid | grantor_uuid | grantee_uuid | email | key_encrypted | atype | status | wait_time_days | recovery_initiated_at | last_notification_at | updated_at | created_at ------+--------------+--------------+-------+---------------+-------+--------+----------------+-----------------------+----------------------+------------+------------ (0 rows) ```
GiteaMirror commented 2026-07-13 20:11:06 -05:00
Author
Owner
Copy Link
Copy Source

@BlackDex commented on GitHub (Nov 11, 2025):

@PedroDuarteMesquitaPinto-ops, could you test the latest testing tagged container please?
As the version you posted is a85b4851, which doesn't contain a fix i added after that.

<!-- gh-comment-id:3517999352 --> @BlackDex commented on GitHub (Nov 11, 2025): @PedroDuarteMesquitaPinto-ops, could you test the latest `testing` tagged container please? As the version you posted is `a85b4851`, which doesn't contain a fix i added after that.
GiteaMirror commented 2026-07-13 20:11:06 -05:00
Author
Owner
Copy Link
Copy Source

@PedroDuarteMesquitaPinto-ops commented on GitHub (Nov 12, 2025):

Now on the latest testing tag that points to "2242416cc1436f3a3ca3a6c1104d0f384924e9690ec437f85284e3f165364e8c"

2025-11-12T09:50:04.602587091Z [2025-11-12 09:50:04.602][request][INFO] POST /identity/connect/token
2025-11-12T09:50:04.945963453Z [2025-11-12 09:50:04.945][response][INFO] (login) POST /identity/connect/token => 200 OK
2025-11-12T09:50:04.990815328Z [2025-11-12 09:50:04.990][request][INFO] GET /api/sync?excludeDomains=true
2025-11-12T09:50:05.034573672Z [2025-11-12 09:50:05.034][response][INFO] (sync) GET /api/sync?<data..> => 200 OK
2025-11-12T09:50:05.128713548Z [2025-11-12 09:50:05.128][request][INFO] GET /api/emergency-access/trusted
2025-11-12T09:50:05.132943168Z [2025-11-12 09:50:05.132][response][INFO] (get_contacts) GET /api/emergency-access/trusted => 200 OK
2025-11-12T09:50:05.172721399Z [2025-11-12 09:50:05.172][request][INFO] GET /api/users/public-key
2025-11-12T09:50:05.173391218Z [2025-11-12 09:50:05.172][response][INFO] (web_files) GET /<p..> [10] => 404 Not Found
<!-- gh-comment-id:3521114513 --> @PedroDuarteMesquitaPinto-ops commented on GitHub (Nov 12, 2025): Now on the latest testing tag that points to "2242416cc1436f3a3ca3a6c1104d0f384924e9690ec437f85284e3f165364e8c" ``` 2025-11-12T09:50:04.602587091Z [2025-11-12 09:50:04.602][request][INFO] POST /identity/connect/token 2025-11-12T09:50:04.945963453Z [2025-11-12 09:50:04.945][response][INFO] (login) POST /identity/connect/token => 200 OK 2025-11-12T09:50:04.990815328Z [2025-11-12 09:50:04.990][request][INFO] GET /api/sync?excludeDomains=true 2025-11-12T09:50:05.034573672Z [2025-11-12 09:50:05.034][response][INFO] (sync) GET /api/sync?<data..> => 200 OK 2025-11-12T09:50:05.128713548Z [2025-11-12 09:50:05.128][request][INFO] GET /api/emergency-access/trusted 2025-11-12T09:50:05.132943168Z [2025-11-12 09:50:05.132][response][INFO] (get_contacts) GET /api/emergency-access/trusted => 200 OK 2025-11-12T09:50:05.172721399Z [2025-11-12 09:50:05.172][request][INFO] GET /api/users/public-key 2025-11-12T09:50:05.173391218Z [2025-11-12 09:50:05.172][response][INFO] (web_files) GET /<p..> [10] => 404 Not Found ```
GiteaMirror commented 2026-07-13 20:11:07 -05:00
Author
Owner
Copy Link
Copy Source

@BlackDex commented on GitHub (Nov 12, 2025):

Which web-vault version are you using?
Also, are you using anything like security or firewall tools? Like modsecurity or waf or something, because something seems off, and i can't reproduce it in any way.

Could you maybe provide a screenshot of the browser developer console of the network tab when you tried this.

<!-- gh-comment-id:3521157686 --> @BlackDex commented on GitHub (Nov 12, 2025): Which web-vault version are you using? Also, are you using anything like security or firewall tools? Like modsecurity or waf or something, because something seems off, and i can't reproduce it in any way. Could you maybe provide a screenshot of the browser developer console of the network tab when you tried this.
GiteaMirror commented 2026-07-13 20:11:08 -05:00
Author
Owner
Copy Link
Copy Source

@PedroDuarteMesquitaPinto-ops commented on GitHub (Nov 12, 2025):

The version:

Versions

Server Installed Ok
1.34.3-2ee40d61
Server Latest
1.34.3-2ee40d61
Web Installed Pre-Release
2025.10.1
Web Latest
2025.7.0
Database
PostgreSQL: PostgreSQL 16.10 on x86_64-pc-linux-gnu, compiled by gcc (GCC) 11.2.0, 64-bit

The 404:

Image Image Image
<!-- gh-comment-id:3521248873 --> @PedroDuarteMesquitaPinto-ops commented on GitHub (Nov 12, 2025): The version: > Versions > > Server Installed Ok > 1.34.3-2ee40d61 > Server Latest > 1.34.3-2ee40d61 > Web Installed Pre-Release > 2025.10.1 > Web Latest > 2025.7.0 > Database > PostgreSQL: PostgreSQL 16.10 on x86_64-pc-linux-gnu, compiled by gcc (GCC) 11.2.0, 64-bit The 404: <img width="2538" height="700" alt="Image" src="https://github.com/user-attachments/assets/9bb10f8b-b896-4b98-9f17-cd45fa10669b" /> <img width="1853" height="1138" alt="Image" src="https://github.com/user-attachments/assets/361ed3ce-f7d2-4425-8776-2d69ab5de8ef" /> <img width="1845" height="433" alt="Image" src="https://github.com/user-attachments/assets/dbf712c5-2632-48ae-84d2-ad99c03df8e5" />
GiteaMirror commented 2026-07-13 20:11:08 -05:00
Author
Owner
Copy Link
Copy Source

@BlackDex commented on GitHub (Nov 12, 2025):

Strange. Does this happen on all browsers? What if you use a browser you never used before?

<!-- gh-comment-id:3521269576 --> @BlackDex commented on GitHub (Nov 12, 2025): Strange. Does this happen on all browsers? What if you use a browser you never used before?
GiteaMirror commented 2026-07-13 20:11:08 -05:00
Author
Owner
Copy Link
Copy Source

@BlackDex commented on GitHub (Nov 12, 2025):

I mean, there is nothing in the code of the web-vault or the server which goes to /api/users/public-key.

<!-- gh-comment-id:3521325425 --> @BlackDex commented on GitHub (Nov 12, 2025): I mean, there is nothing in the code of the web-vault or the server which goes to `/api/users/public-key`.
GiteaMirror commented 2026-07-13 20:11:09 -05:00
Author
Owner
Copy Link
Copy Source

@stefan0xC commented on GitHub (Nov 12, 2025):

Well, as far as I can tell this could only be getUserPublicKey if it's called without an id? Which is why I thought that an entry in the emergency access table might be responsible but since it seems to be empty maybe it's something else?

Nevertheless, can you check the response from /api/emergency-access/trusted? Because judging from the size of the response (0.3 kB) it looks like an entry:

{
    "continuationToken":null,
    "data": [{
        "avatarColor":null,
        "email":"<redactedmailadress>",
        "granteeId":"<redacteduuid1>",
        "id":"<redacteduuid2>",
        "name":"stefan",
        "object":"emergencyAccessGranteeDetails",
        "status":2,
        "type":1,
        "waitTimeDays":1
    }],
    "object":"list"
}
<!-- gh-comment-id:3521438299 --> @stefan0xC commented on GitHub (Nov 12, 2025): Well, as far as I can tell this could only be [getUserPublicKey](https://github.com/bitwarden/clients/blob/3681709ff917356a8eafe73b5c29cf7b6c679cac/libs/common/src/services/api.service.ts#L1207-L1210) if it's called without an id? Which is why I thought that an entry in the emergency access table might be responsible but since it seems to be empty maybe it's something else? Nevertheless, can you check the response from `/api/emergency-access/trusted`? Because judging from the size of the response (0.3 kB) it looks like an entry: ```json { "continuationToken":null, "data": [{ "avatarColor":null, "email":"<redactedmailadress>", "granteeId":"<redacteduuid1>", "id":"<redacteduuid2>", "name":"stefan", "object":"emergencyAccessGranteeDetails", "status":2, "type":1, "waitTimeDays":1 }], "object":"list" } ```
GiteaMirror commented 2026-07-13 20:11:10 -05:00
Author
Owner
Copy Link
Copy Source

@stefan0xC commented on GitHub (Nov 12, 2025):

@BlackDex I think the issue is probably caused by our dummy value:

https://github.com/dani-garcia/vaultwarden/blob/2ee40d6105131174fd7be185ef14fc782fcffffb/src/api/core/emergency_access.rs#L48-L66

(I can try later to replicate the issue but I think it's caused by disabling emergency access...)

<!-- gh-comment-id:3521490466 --> @stefan0xC commented on GitHub (Nov 12, 2025): @BlackDex I think the issue is probably caused by our dummy value: https://github.com/dani-garcia/vaultwarden/blob/2ee40d6105131174fd7be185ef14fc782fcffffb/src/api/core/emergency_access.rs#L48-L66 (I can try later to replicate the issue but I think it's caused by disabling emergency access...)
GiteaMirror commented 2026-07-13 20:11:10 -05:00
Author
Owner
Copy Link
Copy Source

@BlackDex commented on GitHub (Nov 12, 2025):

@stefan0xC , ah good find that might be it indeed.

<!-- gh-comment-id:3521502868 --> @BlackDex commented on GitHub (Nov 12, 2025): @stefan0xC , ah good find that might be it indeed.
GiteaMirror commented 2026-07-13 20:11:10 -05:00
Author
Owner
Copy Link
Copy Source

@PedroDuarteMesquitaPinto-ops commented on GitHub (Nov 12, 2025):

{
    "continuationToken": null,
    "data": [
        {
            "email": "",
            "granteeId": "",
            "id": "",
            "name": "NOTE: Emergency Access is disabled!",
            "object": "emergencyAccessGranteeDetails",
            "status": 2,
            "type": 0,
            "waitTimeDays": 0
        }
    ],
    "object": "list"
}
Image Image
<!-- gh-comment-id:3521819729 --> @PedroDuarteMesquitaPinto-ops commented on GitHub (Nov 12, 2025): ``` { "continuationToken": null, "data": [ { "email": "", "granteeId": "", "id": "", "name": "NOTE: Emergency Access is disabled!", "object": "emergencyAccessGranteeDetails", "status": 2, "type": 0, "waitTimeDays": 0 } ], "object": "list" } ``` <img width="1831" height="1076" alt="Image" src="https://github.com/user-attachments/assets/5325afb7-b275-4088-b00a-d9ec1938a7f0" /> <img width="1872" height="537" alt="Image" src="https://github.com/user-attachments/assets/eba52346-5e6f-4d8a-a116-ac8e80e96d11" />
GiteaMirror commented 2026-07-13 20:11:11 -05:00
Author
Owner
Copy Link
Copy Source

@stefan0xC commented on GitHub (Nov 12, 2025):

Yep. That's it. I also get a 404 for /api/users/public-key when I disable emergency access (EMERGENCY_ACCESS_ALLOWED=false):

[2025-11-12 14:25:07.128][request][INFO] GET /api/users/public-key
[2025-11-12 14:25:07.128][rocket::response::responder::_][WARN] Response was `None`.
[2025-11-12 14:25:07.128][rocket::server::_][WARN] Responding with registered (api_not_found) /api 404 catcher.
<!-- gh-comment-id:3521946109 --> @stefan0xC commented on GitHub (Nov 12, 2025): Yep. That's it. I also get a 404 for `/api/users/public-key` when I disable emergency access (`EMERGENCY_ACCESS_ALLOWED=false`): ``` [2025-11-12 14:25:07.128][request][INFO] GET /api/users/public-key [2025-11-12 14:25:07.128][rocket::response::responder::_][WARN] Response was `None`. [2025-11-12 14:25:07.128][rocket::server::_][WARN] Responding with registered (api_not_found) /api 404 catcher. ```
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
better for forum
bug
documentation
duplicate
enhancement
future Vault
good first issue
help wanted
low priority
notes
pull-request
Mirrored from GitHub Pull Request
 question
SSO
Third party
troubleshooting
wontfix
No labels bug
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
GiteaMirror ninjasurge (Kaehlen Rog)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/vaultwarden#35373