starred/vaultwarden
1
0
Fork 0
mirror of https://github.com/dani-garcia/vaultwarden.git synced 2026-02-05 00:29:40 +03:00
Code Issues 32 Packages Projects Releases 10 Wiki Activity

Reports old "Exposed passwords" #855

New Issue
Closed
opened 2026-02-04 23:06:24 +03:00 by OVERLORD · 2 comments
OVERLORD commented 2026-02-04 23:06:24 +03:00
Owner
Copy Link

Originally created by @mcfrojd on GitHub (Nov 1, 2020).

Subject of the issue

The report of exposed passwords still shows me passwords that have been changed.
Is the old passwords stored i db for the "updated password counter"?
And if so, is the report generator including these passwords when generating the report?
Or am i missing some "purge" function that "cleans" the database from old changed passwords?

Your environment

  • Bitwarden_rs version:
    Server Latest 1.17.0
    Web Latest 2.16.1
  • Install method: Docker-compose
  • Clients used: Android app, chrome app
  • Reverse proxy and version: Nginx Reverse Proxy Manager 2.3.1
  • Version of mysql/postgresql:
  • Other relevant information:

Steps to reproduce

When in my web vault, running the tools/report exposed passwords, the report shows me password entries with old (exposed) passwords.
When i click them in the report it shows the old password, and if i click the entry in the vault i see the new changed password (changed 2 month ago)

Expected behaviour

The report should not generate warnings on passwords that have been changed in the vault.

Actual behaviour

Im guessing the old passwords are still stored somewhere and the report generator can still find these old passwords and keeps warning me about them.
I cant see the old password anywhere in the web vault, but if i use search and type in my old exposed password i get a list of entries that have had that password before i changed them, but i cant see that old password when i open the items from the list

Relevant logs

Originally created by @mcfrojd on GitHub (Nov 1, 2020). <!-- # ### NOTE: Please update to the latest version of bitwarden_rs before reporting an issue! This saves you and us a lot of time and troubleshooting. See: https://github.com/dani-garcia/bitwarden_rs/issues/1180 # ### --> <!-- Please fill out the following template to make solving your problem easier and faster for us. This is only a guideline. If you think that parts are unnecessary for your issue, feel free to remove them. Remember to hide/obfuscate personal and confidential information, such as names, global IP/DNS addresses and especially passwords, if necessary. --> ### Subject of the issue The report of exposed passwords still shows me passwords that have been changed. Is the old passwords stored i db for the "updated password counter"? And if so, is the report generator including these passwords when generating the report? Or am i missing some "purge" function that "cleans" the database from old changed passwords? ### Your environment <!-- The version number, obtained from the logs or the admin diagnostics page --> <!-- Remember to check your issue on the latest version first! --> * Bitwarden_rs version: Server Latest 1.17.0 Web Latest 2.16.1 <!-- How the server was installed: Docker image / package / built from source --> * Install method: Docker-compose * Clients used: Android app, chrome app * Reverse proxy and version: Nginx Reverse Proxy Manager 2.3.1 * Version of mysql/postgresql: <!-- if applicable --> * Other relevant information: ### Steps to reproduce <!-- Tell us how to reproduce this issue. What parameters did you set (differently from the defaults) and how did you start bitwarden_rs? --> When in my web vault, running the tools/report exposed passwords, the report shows me password entries with old (exposed) passwords. When i click them in the report it shows the old password, and if i click the entry in the vault i see the new changed password (changed 2 month ago) ### Expected behaviour <!-- Tell us what should happen --> The report should not generate warnings on passwords that have been changed in the vault. ### Actual behaviour <!-- Tell us what happens instead --> Im guessing the old passwords are still stored somewhere and the report generator can still find these old passwords and keeps warning me about them. I cant see the old password anywhere in the web vault, but if i use search and type in my old exposed password i get a list of entries that have had that password before i changed them, but i cant see that old password when i open the items from the list ### Relevant logs <!-- Share some logfiles, screenshots or output of relevant programs with us. -->
OVERLORD commented 2026-02-04 23:06:33 +03:00
Author
Owner
Copy Link

@BlackDex commented on GitHub (Nov 2, 2020):

Hello @mcfrojd,

All this is done client-side via the web-vault which we do not maintain.
For items regarding the web-vault behaving not as expected you are better of going to https://github.com/bitwarden/web/

@BlackDex commented on GitHub (Nov 2, 2020): Hello @mcfrojd, All this is done client-side via the web-vault which we do not maintain. For items regarding the web-vault behaving not as expected you are better of going to https://github.com/bitwarden/web/
OVERLORD commented 2026-02-04 23:06:36 +03:00
Author
Owner
Copy Link

@sichkarmg commented on GitHub (Nov 5, 2020):

Mcfrojd Sorry I could not wait long, I have the same problem.
https://github.com/bitwarden/web/issues/690

@sichkarmg commented on GitHub (Nov 5, 2020): Mcfrojd Sorry I could not wait long, I have the same problem. https://github.com/bitwarden/web/issues/690
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
SSO
Third party
better for forum
bug
bug
documentation
duplicate
enhancement
future Vault
future Vault
future Vault
good first issue
help wanted
low priority
notes
pull-request
Mirrored from GitHub Pull Request
 question
troubleshooting
wontfix
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
OVERLORD
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/vaultwarden#855
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?