If you got the automatic updates on the bitwarden clients, they will show an empty vault if you are selfhosting vaultwarden.
It seems to be an accidental bug in the bitwarden clients that are assuming that they’re talking with official servers
It’s fixed with the latest release of the vaultwarden server that was published a few minutes ago
Thanks so much for the PSA. I’m currently on vacation without any chance to update Vaultwarden but need access to it via the Bitwarden client. Just disabled the auto update in time. I wish I could vote this twice.
Noticed that as well with our selfhosted instance at work and wondered what the deal was.
Guess I now know why.I found this comment on what happened by dani-garcia, one of the main devs:
The short version is that around 8-ish years ago, Bitwarden changed the way the vault items were structured, and Vaultwarden added some backwards compatibility fields to ensure both old and new versions of the clients worked.
These backwards compatibility fields were supposed to be a temporary measure, but for at least the next three years the clients still required them, until we eventually forgot to keep track of them. At some point between 2021 and today, the clients stopped requiring these backwards compatibility fields, but Vaultwarden was still sending them.
This wasn’t a problem until Bitwarden decided to use the backwards compatibility fields in a completely different way, which caused the clients to crash.
Found here: https://github.com/dani-garcia/vaultwarden/discussions/7473
There’s a reason you don’t do things like that…
Apparently nobody in that software team has heard about Knight Capital. They reused a flag and that coupled with a deployment failure that only lasted ~45 minutes caused an over 400 million dollar loss nearly bankrupting the entire company. Ultimately they ended up combining with another company.
The immediate cause of the incident was a deployment failure that left one of eight servers running outdated code, creating an inconsistency in how the system interpreted incoming instructions. The new software reused a flag associated with a legacy function known as “Power Peg,” which had been disabled but not removed from the codebase, and on the unpatched server this flag activated obsolete logic that continuously generated child orders in response to parent orders that the system did not correctly recognize as already filled.
I hadn’t heard of this one before, thanks for posting.
I’ve been leery about bitwarden client updates since the posts awhile back about the new(ish) PE/VC c suite person.
I’m not saying those are related in any way other than the fact that I intentionally haven’t updated my clients to the latest yet and for once it worked out for me :)
Its a lot of coincidences
Do not update any bitwarden client until you can update vaultwarden
If anyone’s Firefox auto updated like mine you can uninstall the extension, go to the Bitwarden extension page on the Firefox website and manually install the old version. Only needed if you can’t update vaultwarden right away.
Switching to Passbolt right now. I have the feeling this is the beginning of the enshitification of Bitwarden.
Such bugs have already appeared in the past. It’s only logical that this happens from time to time, as the creators of bitwarden don’t test the compatobility with 3rd party servers.
What is important is that they’re not deliberately blocking vaultwarden.
Passbolt pales in comparison. The fact I can only get the android app from google play. No thanks. That is a deal breaker right there. I am working towards moving 100% off from google play.
After quickly spinning up a container of it; it feels very unpolished and can’t say it will replace Bitwarden/Vaultwarden for me.
@Marthirial @Wispy2891 They are quickly moving towards enshitification, but this was likely just a planned patch and not intentional shot across the bow. As someone mentioned, they aren’t required to check 3rd party software. But it does suck when it happens.
They still have a good export tool, that’s a reliable canary for enshittification in my experience. See: how Google butchered their export tools to be as annoying as possible for “security” reasons. The harder it is to leave, the more they care about trapping you via friction rather than keeping you via good customer experience
Bitwarden has been in decline for a while. This is definitely not the first sign.
I do love docker + a front end like dockge.
Saw this post, switched to my browser, clicked three buttons; vaultwarden is now updated. Didn’t even move my lazy ass off the couch. (I’m on my phone)
Thanks for the PSA! :)
I was looking for a simple solution like that, thank you kind stranger!
I love podman quadlets, I didn’t do anything and it updated itself 😁
I run watchtower on a cron schedule. It had already fired for today, so it wouldn’t have run again until tomorrow. I could have waited, but manual is just as easy.
Be aware that watchtowerr is not updated anymore and due to the nature of having access to the socket is a security risk.
I can recommend Arcane as a front end. I switched over all my services this last week from multiple dockges to a single arcane (+agents). It’s looking pretty sweet now. Cleans up a lot of bookmarks too 😆
Homepage is my main front end/landing page for reaching/monitoring all my services; but I’ve got both my dockge instances linked together as well, so all my services show up in both.
wow didn’t know dockge could do that!
Thank you for the PSA good friend!
Wow! Thanks for the PSA!
Thanks, probably saved me a lot of headache on my laptop browsers. Fortunately, I don’t use the official Bitwarden client on android partly because this seems to keep happening.
which client do you use on android?
Keyguard. It’s not perfect and makes money from the paid version for syncing changes back to the server as well as offline editing that will then sync when you’re back online. But it was worth it back when I bought it, and it has never broken so far.
Nice that it has support for both KeePass and bitwarden, can use both at the same time?
What’s the pricing (not specified in the play store page), it’s a subscription (so it doesn’t exist for me) or it’s one time?
It seems like it’s a subscription from what I can tell. I see some people buying ‘lifetime’ subscriptions in the play store reviews, so I’m guessing that’s the case. Now, it also looks like it’s from one lone developer with 27 contributors in GitHub. The app can be downloaded from GitHub (I would use obtainium for that), so that’s a good thing. I think supporting developments like this via a subscription (assuming it’s not crazy expensive) should be normalized if the product is good enough. On that factor, I can’t really comment since I just KeePass the hell out of my credentials over Syncthing, but I do believe there’s value in supporting developers like this guy.
Ps. I notice your msn avatar. I’m busy with https://retromessenger.com/. Coming soon for free!
Very nice, I even considered using escargot to patch the old clients but then realized it’s not a great idea security wise
Yeah escargot just doesn’t do it for me. I want to keep using the existing chat network I use daily. But just giving back the MSN vibes.
I created it using gtk4. So it’s cross platform as well. Meaning Linux native. Which I also wanted.
Would love this to work with Signal and Matrix!
Yah that’s possible. I just implemented telegram for now. But depending on the open api like matrix should work for sure as well. Has signal also an open client api?
“Accidental” — you are far more trusting than I
If you check the github discussion from the devs that patched the issue it doesn’t seem intentional to me (not an expert). That being said I assumed the same thing.
My browser auto updated the extension at a very inopportune time and from some reason KDE connect from my phone to computer which is usually very reliable also wouldn’t connect. Was quite annoying until I realized I can just log into the vaultwarden website directly. I don’t think I’ve done that in years
Was wondering why it suddenly was stuck loading, thanks!
Yeah I updated bitearden yesterday and my vault would not load any items. Glad this bug is already fixed!
The packaged Debian version did not get updated yet.
Tale as old as time.
Thank you for this. I thought I was going insane. Time to turn auto updates off
Per the vault warden release notes:
We strongly advice to update as soon as possible.
With the vulnerabilities being patched these days, it seems ill asvised to disable automatic updates for something as critical as a password manager.
it seems ill asvised to disable automatic updates
I use the WatchTower fork for now, but I use it with the run once flag:
volumes: - /var/run/docker.sock:/var/run/docker.sock command: --run-once --cleanupSo, when an update is available, I’ll delay updating until I am rather comfortable that all the early adopters have worked out all the bugs for me. LOL Thanks guys! You’re an invaluable service.
Lmao there it is
