First, I just want to say that this project is wonderful. Thanks for your work.
I was trying to make a HA instance in Kubernetes, using Helm. I used the testing tag, because I needed the SSO integration. If I set a deployment with 2 or more replicas, I have an issue while using the Login with device feature. If I try to use it on the same device (WebUI to authenticate the Desktop App) it works. But, if I try to accept the Login request from another device, it does not works.
As a workaround if I set the replica to 1, worked. Seems that the "accept" is going to the wrong instance, and there is no coordination between the multiple replicas.
Reverse Proxy
traefik 3.5
Host/Server Operating System
Linux
Operating System Version
Kubernetes
Clients
Browser Extension, Web Vault
Client Version
No response
Steps To Reproduce
On Kuberentes, set replica to 2
Try to login using a device.
Try to accept the request from another device.
In the device that was requesting, nothing happens.
In the device that accepted the request, it said that it was ok.
Expected Result
Can login to another device through the request/push option.
Actual Result
Nothing happens. Only works with one instance.
Logs
Screenshots or Videos
No response
Additional Context
No response
Originally created by @dlc-letelier on GitHub (Sep 19, 2025).
Original GitHub issue: https://github.com/dani-garcia/vaultwarden/issues/6305
### Prerequisites
- [x] I have searched the existing **Closed _AND_ Open** [Issues](https://github.com/dani-garcia/vaultwarden/issues?q=is%3Aissue%20) **_AND_** [Discussions](https://github.com/dani-garcia/vaultwarden/discussions?discussions_q=)
- [x] I have searched and read the [documentation](https://github.com/dani-garcia/vaultwarden/wiki/)
### Vaultwarden Support String
### Your environment (Generated via diagnostics page)
* Vaultwarden version: v1.34.3-a2ad1dc7
* Web-vault version: v2025.8.0
* OS/Arch: linux/x86_64
* Running within a container: true (Base: Debian)
* Database type: PostgreSQL
* Database version: PostgreSQL 17.5 (Debian 17.5-1.pgdg110+1) on x86_64-pc-linux-gnu, compiled by gcc (Debian 10.2.1-6) 10.2.1 20210110, 64-bit
* Uses config.json: true
* Uses a reverse proxy: true
* IP Header check: true (X-Real-IP)
* Internet access: true
* Internet access via a proxy: false
* DNS Check: true
* TZ environment: America/Sao_Paulo
* Browser/Server Time Check: true
* Server/NTP Time Check: true
* Domain Configuration Check: true
* HTTPS Check: true
* Websocket Check: true
* HTTP Response Checks: true
### Config & Details (Generated via diagnostics page)
<details><summary>Show Config & Details</summary>
**Environment settings which are overridden:** DOMAIN, SENDS_ALLOWED, USER_ATTACHMENT_LIMIT, TRASH_AUTO_DELETE_DAYS, SIGNUPS_ALLOWED, SIGNUPS_VERIFY, INVITATIONS_ALLOWED, EMERGENCY_ACCESS_ALLOWED, EMAIL_CHANGE_ALLOWED, SHOW_PASSWORD_HINT, ADMIN_TOKEN, INVITATION_ORG_NAME, IP_HEADER, ICON_REDIRECT_CODE, REQUIRE_DEVICE_EMAIL, LOG_TIMESTAMP_FORMAT, SSO_ENABLED, SSO_ONLY, SSO_CLIENT_ID, SSO_CLIENT_SECRET, SSO_AUTHORITY, SSO_SCOPES, SMTP_HOST, SMTP_SECURITY, SMTP_PORT, SMTP_FROM, SMTP_FROM_NAME, SMTP_USERNAME, SMTP_PASSWORD, SMTP_AUTH_MECHANISM, SMTP_ACCEPT_INVALID_CERTS, SMTP_ACCEPT_INVALID_HOSTNAMES
**Config:**
```json
{
"_duo_akey": null,
"_enable_duo": true,
"_enable_email_2fa": true,
"_enable_smtp": true,
"_enable_yubico": true,
"_icon_service_csp": "https://icons.bitwarden.net/",
"_icon_service_url": "https://icons.bitwarden.net/{}/icon.png",
"_ip_header_enabled": true,
"_max_note_size": 10000,
"_smtp_img_src": "***:",
"admin_ratelimit_max_burst": 3,
"admin_ratelimit_seconds": 300,
"admin_session_lifetime": 20,
"admin_token": "***",
"allowed_connect_src": "",
"allowed_iframe_ancestors": "",
"attachments_folder": "/data/attachments",
"auth_request_purge_schedule": "30 * * * * *",
"authenticator_disable_time_drift": false,
"data_folder": "/data",
"database_conn_init": "",
"database_idle_timeout": 600,
"database_max_conns": 10,
"database_min_conns": 2,
"database_timeout": 30,
"database_url": "**********://*************************************************",
"db_connection_retries": 15,
"disable_2fa_remember": false,
"disable_admin_token": false,
"disable_icon_download": false,
"domain": "*****://***********************",
"domain_origin": "*****://***********************",
"domain_path": "",
"domain_set": true,
"duo_context_purge_schedule": "30 * * * * *",
"duo_host": null,
"duo_ikey": null,
"duo_skey": null,
"duo_use_iframe": false,
"email_2fa_auto_fallback": false,
"email_2fa_enforce_on_verified_invite": false,
"email_attempts_limit": 3,
"email_change_allowed": true,
"email_expiration_time": 600,
"email_token_size": 6,
"emergency_access_allowed": true,
"emergency_notification_reminder_schedule": "0 3 * * * *",
"emergency_request_timeout_schedule": "0 7 * * * *",
"enable_db_wal": true,
"enable_websocket": true,
"enforce_single_org_with_reset_pw_policy": false,
"event_cleanup_schedule": "0 10 0 * * *",
"events_days_retain": null,
"experimental_client_feature_flags": "",
"extended_logging": true,
"helo_name": null,
"hibp_api_key": null,
"http_request_block_non_global_ips": true,
"http_request_block_regex": null,
"icon_blacklist_non_global_ips": true,
"icon_blacklist_regex": null,
"icon_cache_folder": "/data/icon_cache",
"icon_cache_negttl": 259200,
"icon_cache_ttl": 2592000,
"icon_download_timeout": 10,
"icon_redirect_code": 302,
"icon_service": "bitwarden",
"incomplete_2fa_schedule": "30 * * * * *",
"incomplete_2fa_time_limit": 3,
"increase_note_size_limit": false,
"invitation_expiration_hours": 120,
"invitation_org_name": "Congregatio",
"invitations_allowed": false,
"ip_header": "X-Real-IP",
"job_poll_interval_ms": 30000,
"log_file": null,
"log_level": "info",
"log_timestamp_format": "%Y-%m-%d %H:%M:%S.%3f",
"login_ratelimit_max_burst": 10,
"login_ratelimit_seconds": 60,
"org_attachment_limit": null,
"org_creation_users": "",
"org_events_enabled": false,
"org_groups_enabled": false,
"password_hints_allowed": true,
"password_iterations": 600000,
"purge_incomplete_sso_nonce": "0 20 0 * * *",
"push_enabled": true,
"push_identity_uri": "https://identity.bitwarden.com",
"push_installation_id": "***",
"push_installation_key": "***",
"push_relay_uri": "https://push.bitwarden.com",
"reload_templates": false,
"require_device_email": false,
"rsa_key_filename": "/data/rsa_key",
"send_purge_schedule": "0 5 * * * *",
"sendmail_command": null,
"sends_allowed": false,
"sends_folder": "/data/sends",
"show_password_hint": false,
"signups_allowed": false,
"signups_domains_whitelist": "",
"signups_verify": true,
"signups_verify_resend_limit": 6,
"signups_verify_resend_time": 3600,
"smtp_accept_invalid_certs": false,
"smtp_accept_invalid_hostnames": false,
"smtp_auth_mechanism": "Login",
"smtp_debug": false,
"smtp_embed_images": true,
"smtp_explicit_tls": null,
"smtp_from": "*************************",
"smtp_from_name": "Vault Warden",
"smtp_host": "*********************",
"smtp_password": "***",
"smtp_port": 465,
"smtp_security": "force_tls",
"smtp_ssl": null,
"smtp_timeout": 15,
"smtp_username": "********",
"sso_allow_unknown_email_verification": false,
"sso_audience_trusted": null,
"sso_auth_only_not_session": false,
"sso_authority": "*****://*****************************************************",
"sso_authorize_extra_params": "",
"sso_callback_path": "*****://****************************************************",
"sso_client_cache_expiration": 0,
"sso_client_id": "****************************************",
"sso_client_secret": "***",
"sso_debug_tokens": false,
"sso_enabled": true,
"sso_master_password_policy": null,
"sso_only": false,
"sso_pkce": true,
"sso_scopes": "email profile offline_access",
"sso_signups_match_email": true,
"templates_folder": "/data/templates",
"tmp_folder": "/data/tmp",
"trash_auto_delete_days": 30,
"trash_purge_schedule": "0 5 0 * * *",
"use_sendmail": false,
"use_syslog": false,
"user_attachment_limit": 100000,
"user_send_limit": null,
"web_vault_enabled": true,
"web_vault_folder": "web-vault/",
"yubico_client_id": null,
"yubico_secret_key": null,
"yubico_server": null
}
```
</details>
### Vaultwarden Build Version
v1.34.3-a2ad1dc7
### Deployment method
Official Container Image
### Custom deployment method
Hello,
First, I just want to say that this project is wonderful. Thanks for your work.
I was trying to make a HA instance in Kubernetes, using Helm. I used the `testing` tag, because I needed the SSO integration. If I set a deployment with 2 or more replicas, I have an issue while using the Login with device feature. If I try to use it on the same device (WebUI to authenticate the Desktop App) it works. But, if I try to accept the Login request from another device, it does not works.
As a workaround if I set the replica to 1, worked. Seems that the "accept" is going to the wrong instance, and there is no coordination between the multiple replicas.
### Reverse Proxy
traefik 3.5
### Host/Server Operating System
Linux
### Operating System Version
Kubernetes
### Clients
Browser Extension, Web Vault
### Client Version
_No response_
### Steps To Reproduce
1. On Kuberentes, set replica to 2
2. Try to login using a device.
3. Try to accept the request from another device.
4. In the device that was requesting, nothing happens.
5. In the device that accepted the request, it said that it was ok.
### Expected Result
Can login to another device through the request/push option.
### Actual Result
Nothing happens. Only works with one instance.
### Logs
```text
```
### Screenshots or Videos
_No response_
### Additional Context
_No response_
GiteaMirror
added the bug label 2026-07-17 17:20:50 -05:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Originally created by @dlc-letelier on GitHub (Sep 19, 2025).
Original GitHub issue: https://github.com/dani-garcia/vaultwarden/issues/6305
Prerequisites
Vaultwarden Support String
Your environment (Generated via diagnostics page)
Config & Details (Generated via diagnostics page)
Show Config & Details
Environment settings which are overridden: DOMAIN, SENDS_ALLOWED, USER_ATTACHMENT_LIMIT, TRASH_AUTO_DELETE_DAYS, SIGNUPS_ALLOWED, SIGNUPS_VERIFY, INVITATIONS_ALLOWED, EMERGENCY_ACCESS_ALLOWED, EMAIL_CHANGE_ALLOWED, SHOW_PASSWORD_HINT, ADMIN_TOKEN, INVITATION_ORG_NAME, IP_HEADER, ICON_REDIRECT_CODE, REQUIRE_DEVICE_EMAIL, LOG_TIMESTAMP_FORMAT, SSO_ENABLED, SSO_ONLY, SSO_CLIENT_ID, SSO_CLIENT_SECRET, SSO_AUTHORITY, SSO_SCOPES, SMTP_HOST, SMTP_SECURITY, SMTP_PORT, SMTP_FROM, SMTP_FROM_NAME, SMTP_USERNAME, SMTP_PASSWORD, SMTP_AUTH_MECHANISM, SMTP_ACCEPT_INVALID_CERTS, SMTP_ACCEPT_INVALID_HOSTNAMES
Config:
Vaultwarden Build Version
v1.34.3-a2ad1dc7
Deployment method
Official Container Image
Custom deployment method
Hello,
First, I just want to say that this project is wonderful. Thanks for your work.
I was trying to make a HA instance in Kubernetes, using Helm. I used the
testingtag, because I needed the SSO integration. If I set a deployment with 2 or more replicas, I have an issue while using the Login with device feature. If I try to use it on the same device (WebUI to authenticate the Desktop App) it works. But, if I try to accept the Login request from another device, it does not works.As a workaround if I set the replica to 1, worked. Seems that the "accept" is going to the wrong instance, and there is no coordination between the multiple replicas.
Reverse Proxy
traefik 3.5
Host/Server Operating System
Linux
Operating System Version
Kubernetes
Clients
Browser Extension, Web Vault
Client Version
No response
Steps To Reproduce
Expected Result
Can login to another device through the request/push option.
Actual Result
Nothing happens. Only works with one instance.
Logs
Screenshots or Videos
No response
Additional Context
No response