# Vaultwarden 1.37.5 patches two medium-severity security flaws in icons, emergency access

> **Key takeaway:** The Rust-based Bitwarden server implementation fixes two pending-CVE vulnerabilities and tightens configuration validation while adding compatibility for newer web vault versions.

**Published:** 2026-11-01T22:16:50+00:00 
**Source:** Vaultwarden (Bitwarden Server in Rust) 
**Category:** cybersecurity 
**Canonical URL:** https://fosswire.org/news/vaultwarden-1375-patches-two-medium-severity-security-flaws-.html 

## Summary
Vaultwarden 1.37.5, the open-source Rust implementation of the Bitwarden password manager server, ships with security fixes for two medium-severity advisories affecting website icon fetching (GHSA-x9cq-f669-vrr4, CVSS 5.3) and emergency access functionality (GHSA-9pjj-f9g5-3x4c, CVSS 4.3). CVE identifiers are pending and the advisories remain private until publication. The release also makes itself mandatory for users of newer web vault versions: 2026.7.1 or later requires this server version to enable or disable two-factor authentication methods, and 2026.9.0 or later needs it for emergency access account takeover.

Beyond security, the update upgrades the bundled web vault to 2026.10.1, moves the underlying web framework to Rocket v0.5.2, and introduces stricter configuration validation that now halts startup on invalid values. Numeric parameters such as LOGIN_RATELIMIT_MAX_BURST and TRASH_AUTO_DELETE_DAYS are capped at 65535, rate-limit and database timeout options must be at least 1, and cron expressions are validated for scheduled purge jobs. The release also brings riscv64 architecture support, improved WebSocket connection handling, and numerous upstream parity fixes for features including group management, cipher sharing, and audit logging.

## Security fixes and configuration hardening in 1.37.5
- **Pending CVEs in icons and emergency access:** Two medium-severity vulnerabilities are patched with CVSS scores of 5.3 (website icons, GHSA-x9cq-f669-vrr4) and 4.3 (emergency access, GHSA-9pjj-f9g5-3x4c); CVE assignment is pending and details remain embargoed.
- **Mandatory upgrade for modern web vault compatibility:** Server 1.37.5 is required to toggle 2FA methods in web vault 2026.7.1+ and to perform emergency access account takeover in 2026.9.0+; the bundled web vault advances to 2026.10.1.
- **Configuration validation now fails closed:** Invalid configuration values stop startup with an error rather than being silently accepted; numeric bounds enforce maximums of 65535 for several options and 255 for EMAIL_ATTEMPTS_LIMIT, with minimums of 1 for timeout and burst parameters.
- **Framework and dependency updates:** The server upgrades to Rocket v0.5.2 and refreshes its crate dependencies; expired cookies are pruned from the icon cookie jar and WebSocket connections that stop responding are now closed.
- **Platform and feature expansion:** riscv64 architecture support is added, SSO logins gain corrected email 2FA on iOS and Android, and new feature flags cover Windows desktop Autotype, biometrics-sdk-ipc, and Fill Assist with policy controls.

## Why it matters
Self-hosted password infrastructure represents a critical trust anchor for Linux administrators and privacy-conscious users, making prompt security updates essential even when CVE details remain under embargo. The stricter configuration validation reduces operational risk for deployments while the riscv64 support extends Vaultwarden's hardware portability. For the broader open-source security ecosystem, this release demonstrates how independent server implementations can maintain parity with upstream commercial features while shipping transparent, community-audited fixes.