mirror of
https://github.com/dani-garcia/vaultwarden.git
synced 2026-07-17 09:22:30 -05:00
[GH-ISSUE #7401] Long invitation links (JWT tokens) broken by quoted-printable encoding in some email clients (SOGo / K-9) #35651
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/vaultwarden#35651
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @aronmal on GitHub (Jul 5, 2026).
Original GitHub issue: https://github.com/dani-garcia/vaultwarden/issues/7401
Prerequisites
Vaultwarden Support String
Your environment (Generated via diagnostics page)
Config & Details (Generated via diagnostics page)
Show Config & Details
Environment settings which are overridden: DOMAIN, SIGNUPS_ALLOWED, INVITATIONS_ALLOWED, ADMIN_TOKEN, YUBICO_CLIENT_ID, YUBICO_SECRET_KEY, SMTP_HOST, SMTP_SECURITY, SMTP_PORT, SMTP_FROM, SMTP_USERNAME, SMTP_PASSWORD
Config:
Vaultwarden Build Version
v1.36.0
Deployment method
Official Container Image
Custom deployment method
No response
Reverse Proxy
nginx
Host/Server Operating System
Linux
Operating System Version
Debian 13
Clients
Desktop
Client Version
SOGo Webmail mailcow 2026-05c - K-9 Mail 20.0 - Geary 44.1
Steps To Reproduce
SIGNUPS_ALLOWED=falseandINVITATIONS_ALLOWED=truein your configuration.Expected Result
The pasted link should be the complete, functional URL including the full JWT token, allowing the user to accept the invitation and register.
Actual Result
The copied link is heavily truncated and broken. In my case, the email clients truncate the URL visually with
***right where thequoted-printablesoft line break occurs in the MIME source. When selecting "Copy Link", the clipboard contains this broken display value instead of the actualhreftarget:https://passwords.domain.de/#/accept-organization/?email=user%40domain.de&organization***=Because the token is missing, the registration is immediately blocked by Vaultwarden.
Note: This behavior is highly client-dependent. Testing with the "Geary" email client on Linux showed that it copies the link perfectly fine, properly decoding the quoted-printable format. However, since several major clients (like SOGo and K-9) fail at this, it's a significant usability roadblock.
Logs
Screenshots or Videos
E-Mail Source (Click to expand)
Just the body without the headers
Additional Context
I have verified the MIME source of the email. Vaultwarden generates a perfectly valid email with
Content-Transfer-Encoding: quoted-printable. However, because the JWT token makes the invitation URL extremely long, it forces soft line breaks (=) in the source code.Plaintext
While this is technically a client-side clipboard/parsing bug in SOGo and K-9 Mail (as proven by the fact that the "Geary" client handles it correctly), Vaultwarden's extremely long JWT-based URLs make the quoted-printable encoding highly fragile across the email ecosystem. Users often end up copying the truncated display value instead of the
hreftarget.Suggestion for Vaultwarden:
Instead of altering the token length or architecture, a robust and simple fix would be to change the
Content-Transfer-Encodingfor these emails fromquoted-printabletobase64.Using
base64would completely eliminate the need for soft line breaks (=) inside the long URLs within the MIME source, avoiding these widespread copy-paste rendering bugs in strict or flawed email clients.@BlackDex commented on GitHub (Jul 6, 2026):
The problem with base64 is that those are flagged earlier as spam, especially if there are links in them.
The RFC states that clients need to merge the line breaks, so the clients are the actual problem here, not Vaultwarden.