What bitwarden/server shipped

This week: authorization grants now save on change so active sessions stop timing out, missing icons return 404, collection reads apply the highest group permission, and SSO JIT provisioning gets finish endpoints for trusted devices and Key Connector.

This week's server changes: authorization grants are now saved when they change, which stops active users on non-MSSQL databases from being timed out and forced to sign in again. Icon requests return 404 when a domain has no icon instead of serving a placeholder. Collection and cipher reads now apply the highest permission level when groups grant different levels, and an automatic access rule now takes precedence over an older human-approval rule on the same cipher. SSO JIT provisioned users get finish endpoints for trusted device and Key Connector onboarding, owners get an endpoint to remove Privileged Controls, and self-hosted instances can turn off email verification for invite links. Mail delivery also moves into its own library.

Sync now returns one row per cipher instead of one per access group. Event logs use server time. Invite reminders now send fresh links. Email verification is set on a valid emailed OTP. Privileged Controls gained a purchase endpoint and a seat cap, and invite links have their own

This week's server work focused on correctness in sync, events and billing. The sync stored procedures now return one row per cipher rather than one row per access group, so users with many groups no longer get duplicated items. Collected events are stamped with server time, so organization logs no longer mix two clocks. A new command sends reminder emails with fresh invite links to members who have not accepted, and the verify-otp endpoint now marks email as verified on success. Invite links for emergency access, providers and business units have their own lifetime settings. Privileged Controls gained a purchase endpoint and a seat cap at Password Manager seats.

This week: user cipher rows now stream during sync to prevent out-of-memory errors, provider ability caches stay in sync with Admin Console updates, registration only marks email verified when the token was emailed, incomplete_expired organization subscriptions can restart, and f

This week's server work focuses on reliability and consistency. User cipher rows are now streamed during sync so large vaults no longer risk out-of-memory failures, and provider ability caches stay in sync when provider records change in the Admin Console. Registration now marks an email verified only when the verification token was actually sent by email. Organizations with an incomplete_expired subscription can restart it, and file Sends no longer require email verification. Seeder tooling also gained stricter checks that reject data production would never allow, including cloud-only data on self-hosted instances.

Version 2026.10.0 is out with temporary link sharing and configurable access token lifetime. This week also added cipher data shape checks, SSRF protections for OIDC, and PAM rotation audit events.

Version 2026.10.0 is available, adding support for sharing vault items through temporary links and a setting to configure access token lifetime. The week's changes also tightened cipher create and update endpoints so Data must match the cipher Type, added SSRF protections to the OpenID Connect backchannel HTTP client, and let clients report the Cipher_ClientHttpAuthReleased event. PAM work included requiring Edit on an item to manage its rotation, recording rotation outcomes in the organization event log, and rejecting partial-shaped cipher writes in PAM organizations.

This week: group creation, cipher creation, the admin cipher endpoint and account recovery all got stricter access checks. Trial stays alive when redeeming the annual upgrade offer. U2F-migrated YubiKeys work for 2FA again. PAM gained cipher leases, notifications and an audit API

This week's server changes focus on access control and billing correctness. Creating a group now validates collection access like updating one does, cipher creation checks collection permissions, the admin cipher endpoint no longer authorizes custom roles via the org-wide collection check, and account recovery no longer trusts a caller-supplied data protection sentinel. On billing, redeeming the annual upgrade offer during a free trial no longer ends the trial and invoices a full period, and that fix was cherry-picked to the release branch. Two-factor login works again for YubiKeys registered as U2F and migrated to WebAuthn. PAM work continued with cipher lease APIs and a commercial gate, access notifications, and an access audit API.

V2026.9.2 ships with new org endpoints for collections and login ciphers, Teams channel selection, invoice previews, improved item deletion policies, and multiple infrastructure improvements.

Bitwarden v2026.9.2 adds new organization API endpoints for accessing collections and login ciphers with detailed metadata, enables Teams integration to post to specific channels, includes invoice preview functionality for purchases, strengthens item deletion policy enforcement, and resolves several infrastructure reliability issues.

This week: SCIM 2.0 discovery endpoints for Microsoft Entra eligibility, fixed collection access validation, Teams integration TenantId support, and security updates for billing and SSO error handling.

New in Bitwarden server: SCIM 2.0 discovery endpoints (ServiceProviderConfig, Schemas, ResourceTypes) now available for RFC 7643/7644 compliance and Microsoft Entra App Gallery eligibility. Also shipped: fixed collection access validation to prevent invalid permission combinations, Teams integration TenantId requirement, configurable dead letter queue cleanup intervals, and security improvements for billing and SSO error disclosure.

Bitwarden Server 2026.9.0 is live. Secrets versioning, Fido2 v4, dead letter retention for event integrations, access control scoping fixes, and PAM email notifications.

Bitwarden Server 2026.9.0 is now available. This release includes secrets versioning with feature flag gating, completed Fido2 v4 migration, dead letter retention for event integrations to prevent queue growth, access control scoping fixes for invited members and collections, enhanced encrypted string validation, and a new PAM email notification system for access request decisions.