this post was submitted on 24 Jul 2026
548 points (99.3% liked)

Selfhosted

61070 readers
1076 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

Detailed Rules Post

  1. Be civil.

  2. No spam.

  3. Posts are to be related to self-hosting.

  4. Don't duplicate the full text of your blog or readme if you're providing a link.

  5. Submission headline should match the article title.

  6. No trolling.

  7. Promotion posts require active participation, with an account that is at least 30 days old. F/LOSS without a paywall has exceptions, with requirements. See the rules link for details. Tags [CBH] or [AIP] are required, see the links in Rule 8 for details.

  8. AI-related discussions and AI-involved promotional posts have additional requirements for tagging, as noted in Rule 7 and the AI & Promotional Post Expanded Rules post, and find example disclosures here.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 3 years ago
MODERATORS
ruud@lemmy.world
Loki@lemmy.world
CannaVet@lemmy.world
devve@lemmy.world
ayyy@sh.itjust.works
curbstickle@anarchist.nexus
curbstickle_lw@lemmy.world
548
PSA: the bitwarden clients got an upgrade that makes them incompatible with vaultwarden (github.com)
submitted 1 week ago by Wispy2891@lemmy.world to c/selfhosted@lemmy.world
60 comments fedilink hide all child comments
 

If you got the automatic updates on the bitwarden clients, they will show an empty vault if you are selfhosting vaultwarden.

It seems to be an accidental bug in the bitwarden clients that are assuming that they're talking with official servers

It's fixed with the latest release of the vaultwarden server that was published a few minutes ago

top 50 comments
sorted by: hot top controversial new old
[–] SmoothLiquidation@lemmy.world 88 points 6 days ago* (last edited 6 days ago) (1 children)

I found this comment on what happened by dani-garcia, one of the main devs:

The short version is that around 8-ish years ago, Bitwarden changed the way the vault items were structured, and Vaultwarden added some backwards compatibility fields to ensure both old and new versions of the clients worked.

These backwards compatibility fields were supposed to be a temporary measure, but for at least the next three years the clients still required them, until we eventually forgot to keep track of them. At some point between 2021 and today, the clients stopped requiring these backwards compatibility fields, but Vaultwarden was still sending them.

This wasn't a problem until Bitwarden decided to use the backwards compatibility fields in a completely different way, which caused the clients to crash.

Found here: https://github.com/dani-garcia/vaultwarden/discussions/7473

[–] JordanZ@lemmy.world 44 points 6 days ago (1 children)

There’s a reason you don’t do things like that…

Apparently nobody in that software team has heard about Knight Capital. They reused a flag and that coupled with a deployment failure that only lasted ~45 minutes caused an over 400 million dollar loss nearly bankrupting the entire company. Ultimately they ended up combining with another company.

The immediate cause of the incident was a deployment failure that left one of eight servers running outdated code, creating an inconsistency in how the system interpreted incoming instructions. The new software reused a flag associated with a legacy function known as “Power Peg,” which had been disabled but not removed from the codebase, and on the unpatched server this flag activated obsolete logic that continuously generated child orders in response to parent orders that the system did not correctly recognize as already filled.

More details

[–] eleijeep@piefed.social 11 points 6 days ago* (last edited 10 hours ago)

I hadn't heard of this one before, thanks for posting.

Edit: this website is very strange. The article is dated 5th June 2019 and the other "case studies" are dated to look like they've been writing regularly since 2019 up until now. But the article reads like LLM output, and the waybackmachine has no record of this article before December 2025, and no record of the domain name henricodolfing.ch before April 2025. The whois database says that the domain was registered in January 2025. So are they really trying to launder slop by back-dating it to make it look like it was written before LLMs existed? Fuck.

[–] ShadowZone@lemmy.world 40 points 6 days ago (1 children)

Thanks so much for the PSA. I'm currently on vacation without any chance to update Vaultwarden but need access to it via the Bitwarden client. Just disabled the auto update in time. I wish I could vote this twice.

[–] eneff@discuss.tchncs.de 10 points 6 days ago (1 children)

Enjoy your vacation! ~

[–] HeyThisIsntTheYMCA@lemmy.world 5 points 5 days ago* (last edited 5 days ago)

i'm in shadowzone's house right now and vaultwarden's working great :3

[–] clif@lemmy.world 40 points 6 days ago (2 children)

I've been leery about bitwarden client updates since the posts awhile back about the new(ish) PE/VC c suite person.

I'm not saying those are related in any way other than the fact that I intentionally haven't updated my clients to the latest yet and for once it worked out for me :)

[–] mysticalone@lemmy.world 12 points 6 days ago

Its a lot of coincidences

[–] other_cat@lemmy.zip 2 points 5 days ago

As soon as that news came down I immediately went to my extension and turned off auto-updates. Glad I did now!

[–] mik3dd0@lemmy.ml 7 points 5 days ago

Just did the update of vaultwarden. Had to log out and log back again in bitwarden on my browser. On the phone it seems to just have worked. Thank you for the PSA :)

[–] Appoxo@lemmy.dbzer0.com 8 points 6 days ago* (last edited 6 days ago)

Noticed that as well with our selfhosted instance at work and wondered what the deal was.
Guess I now know why.

[–] Magnum@infosec.pub 3 points 6 days ago

Thanks for the PSA, I got hit before any of this was live

[–] Magnum@infosec.pub 4 points 6 days ago (1 children)

The packaged Debian version did not get updated yet.

[–] SatyrSack@quokk.au 20 points 6 days ago (1 children)

Tale as old as time.

[–] Magnum@infosec.pub 1 points 2 days ago

It did get already updated though 😅

[–] Wispy2891@lemmy.world 127 points 1 week ago (9 children)

Do not update any bitwarden client until you can update vaultwarden

[–] Lem453@lemmy.ca 30 points 6 days ago

If anyone's Firefox auto updated like mine you can uninstall the extension, go to the Bitwarden extension page on the Firefox website and manually install the old version. Only needed if you can't update vaultwarden right away.

load more comments (8 replies)
[–] Darkassassin07@lemmy.ca 48 points 1 week ago (5 children)

I do love docker + a front end like dockge.

Saw this post, switched to my browser, clicked three buttons; vaultwarden is now updated. Didn't even move my lazy ass off the couch. (I'm on my phone)

Thanks for the PSA! :)

[–] Grandwolf319@sh.itjust.works 5 points 6 days ago

I was looking for a simple solution like that, thank you kind stranger!

[–] fozid@feddit.uk 18 points 1 week ago (1 children)

I love podman quadlets, I didn't do anything and it updated itself 😁

[–] Darkassassin07@lemmy.ca 6 points 6 days ago (1 children)

I run watchtower on a cron schedule. It had already fired for today, so it wouldn't have run again until tomorrow. I could have waited, but manual is just as easy.

[–] Appoxo@lemmy.dbzer0.com 6 points 6 days ago (1 children)

Be aware that watchtowerr is not updated anymore and due to the nature of having access to the socket is a security risk.

[–] Darkassassin07@lemmy.ca 1 points 6 days ago* (last edited 6 days ago)

That's one of the joys of FOSS, when the dev for a popular project can't continue; there's often someone willing to pick up the torch and carry it forward.

I switched to this fork when the one you're thinking of ended development.

https://github.com/nicholas-fedor/watchtower

Last update 3 days ago.

load more comments (3 replies)
[–] guynamedzero@piefed.zeromedia.vip 24 points 1 week ago

Wow! Thanks for the PSA!

[–] melroy@kbin.melroy.org 16 points 1 week ago (5 children)

Ps. I notice your msn avatar. I'm busy with https://retromessenger.com/. Coming soon for free!

[–] Wispy2891@lemmy.world 3 points 6 days ago (1 children)

Very nice, I even considered using escargot to patch the old clients but then realized it's not a great idea security wise

[–] melroy@kbin.melroy.org 2 points 6 days ago

Yeah escargot just doesn't do it for me. I want to keep using the existing chat network I use daily. But just giving back the MSN vibes.

I created it using gtk4. So it's cross platform as well. Meaning Linux native. Which I also wanted.

load more comments (4 replies)
load more comments
view more: next ›