this post was submitted on 24 Jul 2026
250 points (99.6% liked)

Selfhosted

60911 readers
1006 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

Detailed Rules Post

  1. Be civil.

  2. No spam.

  3. Posts are to be related to self-hosting.

  4. Don't duplicate the full text of your blog or readme if you're providing a link.

  5. Submission headline should match the article title.

  6. No trolling.

  7. Promotion posts require active participation, with an account that is at least 30 days old. F/LOSS without a paywall has exceptions, with requirements. See the rules link for details. Tags [CBH] or [AIP] are required, see the links in Rule 8 for details.

  8. AI-related discussions and AI-involved promotional posts have additional requirements for tagging, as noted in Rule 7 and the AI & Promotional Post Expanded Rules post, and find example disclosures here.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 3 years ago
MODERATORS
ruud@lemmy.world
Loki@lemmy.world
CannaVet@lemmy.world
devve@lemmy.world
ayyy@sh.itjust.works
curbstickle@anarchist.nexus
curbstickle_lw@lemmy.world
250
PSA: the bitwarden clients got an upgrade that makes them incompatible with vaultwarden (github.com)
submitted 17 hours ago by Wispy2891@lemmy.world to c/selfhosted@lemmy.world
37 comments fedilink hide all child comments
 

If you got the automatic updates on the bitwarden clients, they will show an empty vault if you are selfhosting vaultwarden.

It seems to be an accidental bug in the bitwarden clients that are assuming that they're talking with official servers

It's fixed with the latest release of the vaultwarden server that was published a few minutes ago

all 38 comments
sorted by: hot top controversial new old
[–] SmoothLiquidation@lemmy.world 28 points 11 hours ago* (last edited 11 hours ago) (1 children)

I found this comment on what happened by dani-garcia, one of the main devs:

The short version is that around 8-ish years ago, Bitwarden changed the way the vault items were structured, and Vaultwarden added some backwards compatibility fields to ensure both old and new versions of the clients worked.

These backwards compatibility fields were supposed to be a temporary measure, but for at least the next three years the clients still required them, until we eventually forgot to keep track of them. At some point between 2021 and today, the clients stopped requiring these backwards compatibility fields, but Vaultwarden was still sending them.

This wasn't a problem until Bitwarden decided to use the backwards compatibility fields in a completely different way, which caused the clients to crash.

Found here: https://github.com/dani-garcia/vaultwarden/discussions/7473

[–] JordanZ@lemmy.world 6 points 2 hours ago (1 children)

There’s a reason you don’t do things like that…

Apparently nobody in that software team has heard about Knight Capital. They reused a flag and that coupled with a deployment failure that only lasted ~45 minutes caused an over 400 million dollar loss nearly bankrupting the entire company. Ultimately they ended up combining with another company.

The immediate cause of the incident was a deployment failure that left one of eight servers running outdated code, creating an inconsistency in how the system interpreted incoming instructions. The new software reused a flag associated with a legacy function known as “Power Peg,” which had been disabled but not removed from the codebase, and on the unpatched server this flag activated obsolete logic that continuously generated child orders in response to parent orders that the system did not correctly recognize as already filled.

More details

[–] eleijeep@piefed.social 1 points 1 hour ago

I hadn't heard of this one before, thanks for posting.

[–] clif@lemmy.world 22 points 13 hours ago (1 children)

I've been leery about bitwarden client updates since the posts awhile back about the new(ish) PE/VC c suite person.

I'm not saying those are related in any way other than the fact that I intentionally haven't updated my clients to the latest yet and for once it worked out for me :)

[–] mysticalone@lemmy.world 4 points 10 hours ago

Its a lot of coincidences

[–] Wispy2891@lemmy.world 71 points 17 hours ago (2 children)

Do not update any bitwarden client until you can update vaultwarden

[–] Lem453@lemmy.ca 12 points 13 hours ago

If anyone's Firefox auto updated like mine you can uninstall the extension, go to the Bitwarden extension page on the Firefox website and manually install the old version. Only needed if you can't update vaultwarden right away.

[–] Darkassassin07@lemmy.ca 33 points 16 hours ago (3 children)

I do love docker + a front end like dockge.

Saw this post, switched to my browser, clicked three buttons; vaultwarden is now updated. Didn't even move my lazy ass off the couch. (I'm on my phone)

Thanks for the PSA! :)

[–] Grandwolf319@sh.itjust.works 4 points 10 hours ago

I was looking for a simple solution like that, thank you kind stranger!

[–] myrmidex@belgae.social 6 points 13 hours ago* (last edited 13 hours ago) (1 children)

I can recommend Arcane as a front end. I switched over all my services this last week from multiple dockges to a single arcane (+agents). It's looking pretty sweet now. Cleans up a lot of bookmarks too 😆

[–] Darkassassin07@lemmy.ca 3 points 11 hours ago* (last edited 11 hours ago) (1 children)

Homepage is my main front end/landing page for reaching/monitoring all my services; but I've got both my dockge instances linked together as well, so all my services show up in both.

[–] myrmidex@belgae.social 3 points 11 hours ago

wow didn't know dockge could do that!

[–] fozid@feddit.uk 7 points 14 hours ago (1 children)

I love podman quadlets, I didn't do anything and it updated itself 😁

[–] Darkassassin07@lemmy.ca 3 points 11 hours ago

I run watchtower on a cron schedule. It had already fired for today, so it wouldn't have run again until tomorrow. I could have waited, but manual is just as easy.

[–] irotsoma@piefed.blahaj.zone 7 points 14 hours ago (1 children)

Thanks, probably saved me a lot of headache on my laptop browsers. Fortunately, I don't use the official Bitwarden client on android partly because this seems to keep happening.

[–] pogmommy@lemmy.ml 0 points 7 hours ago (1 children)

which client do you use on android?

[–] irotsoma@piefed.blahaj.zone 1 points 6 hours ago (1 children)

Keyguard. It's not perfect and makes money from the paid version for syncing changes back to the server as well as offline editing that will then sync when you're back online. But it was worth it back when I bought it, and it has never broken so far.

[–] Wispy2891@lemmy.world 1 points 4 hours ago

Nice that it has support for both KeePass and bitwarden, can use both at the same time?

What's the pricing (not specified in the play store page), it's a subscription (so it doesn't exist for me) or it's one time?

[–] guynamedzero@piefed.zeromedia.vip 14 points 17 hours ago

Wow! Thanks for the PSA!

[–] mereo@piefed.ca 7 points 15 hours ago

Thank you for the PSA good friend!

[–] melroy@kbin.melroy.org 6 points 17 hours ago

Ps. I notice your msn avatar. I'm busy with retromessenger.com. Coming soon for free!

[–] ramble81@lemmy.zip 2 points 14 hours ago (1 children)

“Accidental” — you are far more trusting than I

[–] Lem453@lemmy.ca 9 points 13 hours ago

If you check the github discussion from the devs that patched the issue it doesn't seem intentional to me (not an expert). That being said I assumed the same thing.

My browser auto updated the extension at a very inopportune time and from some reason KDE connect from my phone to computer which is usually very reliable also wouldn't connect. Was quite annoying until I realized I can just log into the vaultwarden website directly. I don't think I've done that in years

[–] Magnum@infosec.pub 1 points 12 hours ago (1 children)

The packaged Debian version did not get updated yet.

[–] SatyrSack@quokk.au 11 points 12 hours ago

Tale as old as time.

[–] cultist@feddit.dk 3 points 16 hours ago (1 children)

Was wondering why it suddenly was stuck loading, thanks!

[–] dditty@lemmy.dbzer0.com 3 points 16 hours ago

Yeah I updated bitearden yesterday and my vault would not load any items. Glad this bug is already fixed!

[–] lka1988@sh.itjust.works -4 points 12 hours ago

Lmao there it is

[–] riptide@lemmy.world 1 points 16 hours ago (1 children)

Thank you for this. I thought I was going insane. Time to turn auto updates off

[–] Bazoogle@lemmy.world 13 points 16 hours ago (1 children)

Per the vault warden release notes:

We strongly advice to update as soon as possible.

With the vulnerabilities being patched these days, it seems ill asvised to disable automatic updates for something as critical as a password manager.

[–] irmadlad@lemmy.world 2 points 16 hours ago

it seems ill asvised to disable automatic updates

I use the WatchTower fork for now, but I use it with the run once flag:

 volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    command: --run-once --cleanup

So, when an update is available, I'll delay updating until I am rather comfortable that all the early adopters have worked out all the bugs for me. LOL Thanks guys! You're an invaluable service.