mirror of
https://github.com/dani-garcia/vaultwarden.git
synced 2026-08-26 11:55:50 -05:00
[GH-ISSUE #7383] Title: Self-hosted login fails on first attempt with latest Bitwarden clients; requires workaround toggling server URL #39942
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/vaultwarden#39942
Reference in New Issue
Block a user
Originally created by @LoCCai on GitHub (Jun 29, 2026).
Original GitHub issue: https://github.com/dani-garcia/vaultwarden/issues/7383
Prerequisites
Vaultwarden Support String
Vaultwarden Build Version
new
Deployment method
Official Container Image
Custom deployment method
Environment
Vaultwarden version: [please specify your version, e.g., 1.30.5]
Deployment: Self-hosted behind a reverse proxy (Nginx/Caddy/etc.)
Reverse proxy domain: [your domain]
Affected clients:
Bitwarden Chrome extension (latest version)
Bitwarden Windows desktop client (latest version)
Server configuration: Master password + 2FA (TOTP) enabled on the account
Problem Statement
Users are unable to log in to a self-hosted Vaultwarden instance when using the latest Bitwarden browser extension and Windows desktop client. The login flow fails consistently on the first attempt when the self-hosted server URL is configured.
Steps to Reproduce
Set up a self-hosted Vaultwarden instance behind a reverse proxy with a custom domain.
Install the latest Bitwarden Chrome extension or Windows desktop client.
Open the client and select Self-hosted environment.
Enter the reverse proxy domain as the server URL.
Enter email address and master password on the login form.
Click Log in.
Expected Behavior
The user should be able to log in successfully or, if 2FA is enabled, be prompted for the 2FA code.
Actual Behavior
Login fails without a clear error, and the user cannot proceed to the 2FA prompt. The credentials are rejected even though they are correct.
Workaround (Strange but Consistent)
To successfully log in, the following convoluted workaround is required:
Change the server URL from the self-hosted reverse proxy domain to the official Bitwarden server (https://vault.bitwarden.com).
Enter the email address only and proceed.
When prompted for the master password, enter it and trigger an error response (since the account doesn't exist on the official server).
Switch the server URL back to the self-hosted reverse proxy domain.
Re-enter the credentials.
Login now succeeds, and the 2FA prompt appears as expected.
This workaround is reproducible every time and is required for each new client installation or after clearing local data.
Observations & Suspected Cause
It appears that the client may be performing some form of pre-flight check or key derivation/handshake against the configured server URL that differs between the first request and subsequent ones after a server URL switch. The fact that switching to the official server and back resolves the issue suggests a state initialization problem in the client when connecting to a self-hosted instance directly, possibly related to:
Server configuration discovery (e.g., /api/config or pre-login endpoint behavior)
KDF (Key Derivation Function) parameter negotiation
API version mismatch handling between the latest clients and Vaultwarden
Request
Please investigate the login flow between the latest Bitwarden clients and Vaultwarden to identify what causes the initial login failure. A fix or guidance on server-side configuration adjustments to ensure compatibility with the official clients would be greatly appreciated.
Additional Context
The server has a valid SSL certificate (no TLS issues).
The reverse proxy is correctly configured and passes all API requests through.
The issue is consistently reproducible across multiple devices and browsers.
Let me know if you'd like me to adjust the tone, add any specific error logs, or include additional diagnostic information.
Reverse Proxy
lucky nginx
Host/Server Operating System
Linux
Operating System Version
No response
Clients
Web Vault
Client Version
No response
Steps To Reproduce
Expected Result
Actual Result
Logs
Screenshots or Videos
No response
Additional Context
No response
@stefan0xC commented on GitHub (Jun 29, 2026):
Can you make sure you are using the latest Vaultwarden release? Cf. https://github.com/dani-garcia/vaultwarden/issues/1180
@aloknikhil commented on GitHub (Jun 29, 2026):
I can confirm this issue exists even on the latest version (
1.36.0) as of this post. The workaround did not work for me on the latest extension unfortunately.@BlackDex commented on GitHub (Jun 29, 2026):
Could you please post the support string as requested?
@stefan0xC commented on GitHub (Jun 29, 2026):
I can't reproduce this because I can just login in my existing account (in
v2026.6.0on a fresh chromium profile). Can you also provide the server logs from an unsuccessful login attempt? (If there are none and it just fails the configuration might be incorrect, i.e. that you have added an URI fragment like/#/loginto the server URL?)@rlpowell commented on GitHub (Jun 29, 2026):
I have exactly the same issue. Used to work, had to logout, doesn't work. Version 1.36.0. The workaround listed here worked.
When I was trying earlier, I used the javascript console to look and I got this:
That does, in fact, consistently 404 on my vaultwarden instance.
I am on Windows 10 running Chrome Version 146.0.7680.180 (Official Build) (64-bit) and bitwarden extension 2026.5.1