Remove legacy API endpoints and compatibility code dropped upstream (#7809 )

Remove endpoints, response fields, feature flags and compatibility code that upstream Bitwarden has removed and that no current client uses: - Legacy POST /identity/accounts/register and POST /api/accounts/prelogin; register/finish is rate limited like the other unauthenticated endpoints. - Legacy organization routes: PUT groups/{id}/users, PUT policies/{type}/vnext, PUT users/{id}/reset-password, GET billing/metadata, and the POST aliases of the organization, collection, group and member PUT/DELETE routes. - POST /two-factor/disable (PUT stays). - ResetMasterPassword, captchaBypassToken, the legacy registration name field, userIsManagedByOrganization/managedByOrganization and accessAll. - The automatic email 2FA code for clients older than 2025.5.0. - DUO_USE_IFRAME and the Duo Traditional Prompt code. - Experimental client feature flags that no client reads anymore. - Web vault CSS selectors for web vaults older than 2025.5.1. Also accept the PascalCase fields Android 2026.9.0+ sends on registration and password change, and align a few account, login/2FA and organization checks with upstream. Adds tests for the registration body formats.
Send API cleanup: remove legacy endpoints and align access with upstream (#7806 )
2026-10-24 03:36:40 +03:00 · 2026-10-04 22:16:55 +02:00 · 2026-10-03 23:05:56 +02:00 · 2026-10-03 14:01:26 +02:00 · 2026-10-03 13:50:29 +02:00 · 2026-10-03 13:49:53 +02:00
52 changed files with 2995 additions and 3391 deletions
@@ -180,7 +180,7 @@
 ## Defaults to every minute. Set blank to disable this job.
 # AUTH_REQUEST_PURGE_SCHEDULE="30 * * * * *"
 ##
-## Cron schedule of the job that cleans expired Duo contexts from the database. Does nothing if Duo MFA is disabled or set to use the legacy iframe prompt.
+## Cron schedule of the job that cleans expired Duo contexts from the database. Does nothing if Duo MFA is disabled.
 ## Defaults to every minute. Set blank to disable this job.
 # DUO_CONTEXT_PURGE_SCHEDULE="30 * * * * *"
 #
@@ -391,21 +391,12 @@
 ## The following flags are available:
 ## - "pm-5594-safari-account-switching": Enable account switching in Safari. (Safari >= 2026.2.0)
 ## - "pm-32413-multi-client-password-management": Enable changing the master password directly in the client. (Desktop/Extension >= 2026.4.0)
-## - "ssh-agent": Enable SSH agent support on Desktop. (Desktop >= 2024.12.0)
 ## - "ssh-agent-v2": Enable newer SSH agent support. (Desktop >= 2026.2.1)
-## - "ssh-key-vault-item": Enable the creation and use of SSH key vault items. (Clients >= 2024.12.0)
-## - "pm-25373-windows-biometrics-v2": Enable the new implementation of biometrics on Windows. (Desktop >= 2025.11.0)
-## - "pm-26340-linux-biometrics-v2": Enable the new implementation of biometrics on Linux. (Desktop >= 2025.11.0)
-## - "anon-addy-self-host-alias": Enable configuring self-hosted Anon Addy alias generator. (Android >= 2025.3.0, iOS >= 2025.4.0)
-## - "simple-login-self-host-alias": Enable configuring self-hosted Simple Login alias generator. (Android >= 2025.3.0, iOS >= 2025.4.0)
-## - "mutual-tls": Enable the use of mutual TLS on Android (Clients >= 2025.2.0)
-## - "cxp-import-mobile": Enable the import via CXP on iOS (Clients >= 2025.9.2)
-## - "cxp-export-mobile": Enable the export via CXP on iOS (Clients >= 2025.9.2)
 ## - "pm-30529-webauthn-related-origins":
-## - "desktop-ui-migration-milestone-1": Special feature flag for desktop UI (Desktop >= 2026.2.0)
-## - "desktop-ui-migration-milestone-2": Special feature flag for desktop UI (Desktop >= 2026.2.0)
-## - "desktop-ui-migration-milestone-3": Special feature flag for desktop UI (Desktop >= 2026.2.0)
-## - "desktop-ui-migration-milestone-4": Special feature flag for desktop UI (Desktop >= 2026.2.0)
+## - "pm-32009-new-item-types": Enable new item types: Bank Account, Driver's License, and Passport (Clients >= 2026.4.0)
+## - "pm-34171-card-scanner": Enable the new card scanner feature on mobile (Android >= 2026.4.1, iOS >= 2026.4.1)
+## - "enable-basic-auth-response": Enable HTTP Basic Auth autofill in the browser extension (Browser >= 2026.9.0)
+## - "undetermined-cipher-scenario-logic": Enable the rewritten add/update login notification triggering logic in the browser extension (Browser >= 2026.2.0)
 # EXPERIMENTAL_CLIENT_FEATURE_FLAGS=

 ## Require new device emails. When a user logs in an email is required to be sent.
@@ -584,11 +575,6 @@
 # DUO_HOST=<API Hostname>
 ## After that, you should be able to follow the rest of the guide linked above,
 ## ignoring the fields that ask for the values that you already configured beforehand.
-##
-## If you want to attempt to use Duo's 'Traditional Prompt' (deprecated, iframe based) set DUO_USE_IFRAME to 'true'.
-## Duo no longer supports this, but it still works for some integrations.
-## If you aren't sure, leave this alone.
-# DUO_USE_IFRAME=false

 ## Email 2FA settings
 ## Email token size
@@ -20,7 +20,7 @@ jobs:
    steps:
      # Start Docker Buildx
      - name: Setup Docker Buildx
-        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
        # https://github.com/moby/buildkit/issues/3969
        # Also set max parallelism to 2, the default of 4 breaks GitHub Actions and causes OOMKills
        with:
@@ -58,13 +58,13 @@ jobs:

    steps:
      - name: Initialize QEMU binfmt support
-        uses: docker/setup-qemu-action@1f40c72289eff860ee54a304f1438e3cff362e0a # v4.3.0
+        uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4.4.0
        with:
          platforms: "arm64,arm"

      # Start Docker Buildx
      - name: Setup Docker Buildx
-        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
        # https://github.com/moby/buildkit/issues/3969
        # Also set max parallelism to 2, the default of 4 breaks GitHub Actions and causes OOMKills
        with:
@@ -185,7 +185,7 @@ jobs:

      - name: Bake ${{ matrix.base_image }} containers
        id: bake_vw
-        uses: docker/bake-action@d3418bd7d0e9324001bca92fa8ba175ea7e6dc9b # v7.3.0
+        uses: docker/bake-action@018cb6412ab401ebaa809aa5f85966b74628600f # v7.4.0
        env:
          BASE_TAGS: "${{ steps.determine-version.outputs.BASE_TAGS }}"
          SOURCE_COMMIT: "${{ env.SOURCE_COMMIT }}"
@@ -50,6 +50,6 @@ jobs:
          severity: CRITICAL,HIGH

      - name: Upload Trivy scan results to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
+        uses: github/codeql-action/upload-sarif@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
        with:
          sarif_file: 'trivy-results.sarif'
@@ -23,4 +23,4 @@ jobs:

      # When this version is updated, do not forget to update this in `.pre-commit-config.yaml` too
      - name: Spell Check Repo
-        uses: crate-ci/typos@d43b6c087ac471e2ea7b8af622ff15f05c0c365b # v1.50.1
+        uses: crate-ci/typos@512fc24f32f44ab01972217aaaf3dc86ec234d53 # v1.50.2
@@ -18,7 +18,7 @@ repos:

  # When this version is updated, do not forget to update this in `.github/workflows/typos.yaml` too
  - repo: https://github.com/crate-ci/typos
-    rev: d43b6c087ac471e2ea7b8af622ff15f05c0c365b # v1.50.1
+    rev: 512fc24f32f44ab01972217aaaf3dc86ec234d53 # v1.50.2
    hooks:
      - id: typos
        always_run: true
@@ -112,7 +112,7 @@ dependencies = [
 "proc-macro2",
 "quote",
 "syn 2.0.119",
- "synstructure",
+ "synstructure 0.13.2",
 ]

 [[package]]
@@ -151,9 +151,9 @@ dependencies = [

 [[package]]
 name = "async-compression"
-version = "0.4.45"
+version = "0.4.48"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "24a8ec73eb862508b7041723c89386365894b4e7d9f6998bf1b8529e5b0ee254"
+checksum = "fb61aea1a7def73ee7c350a184f0e70b32c182344e2e75bf70c9b621b83417fd"
 dependencies = [
 "compression-codecs",
 "compression-core",
@@ -318,18 +318,14 @@ checksum = "82f6aeea286b8eb4dd3431a1be1b59d290ace00f5bfd8e2a159bc2a05e2c1667"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn 3.0.5",
+ "syn 3.0.6",
 ]

 [[package]]
 name = "asyncband"
-version = "0.6.7"
+version = "0.7.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "94a214ba60d6231afd0e805e3c27c45a1626d9debaa5a5061c45a1ea1b2f1ed0"
-dependencies = [
- "hashbrown 0.17.1",
- "slab",
-]
+checksum = "f2d85fd3d291fabcc40c7232c92c280ec1754fd7b5d7ea769f143222143e179a"

 [[package]]
 name = "atomic"
@@ -403,9 +399,9 @@ dependencies = [

 [[package]]
 name = "aws-runtime"
-version = "1.9.2"
+version = "1.9.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ef47857a1d4488b528f4a5d5715fa7c3300820897824152234d3fa22b1426657"
+checksum = "25b43ad47adc2517efe3d706559d94b97e50e80e0321b3cadbc9f77cee88adcd"
 dependencies = [
 "aws-credential-types",
 "aws-sigv4",
@@ -428,9 +424,9 @@ dependencies = [

 [[package]]
 name = "aws-sdk-sso"
-version = "1.109.0"
+version = "1.111.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c3cfe74df5d9ad2fedd691973ad3521ebf4f27a3c68c792556686aedb5519bab"
+checksum = "65700d75f6da78c89a61a49f1539979400a4609d3329376b1dc2133d7a1b2b90"
 dependencies = [
 "arc-swap",
 "aws-credential-types",
@@ -454,9 +450,9 @@ dependencies = [

 [[package]]
 name = "aws-sdk-ssooidc"
-version = "1.111.0"
+version = "1.113.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "81b0ec31ed6191bd11350aae4b2004198f2db21350cb0a20c57e0a92e55dd161"
+checksum = "eb1147c254af7b6cee3ace90ae7da6f21366ce9a9b899035fa8a0fdf586eb75a"
 dependencies = [
 "arc-swap",
 "aws-credential-types",
@@ -480,9 +476,9 @@ dependencies = [

 [[package]]
 name = "aws-sdk-sts"
-version = "1.114.0"
+version = "1.116.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ef45745026107ec30c4ef86bd8ae4b002e7e5f6a86e4225240bdf6b06a0b944a"
+checksum = "035c7392e751d20bf1060d625d023587eb14099646110a9cff7c697bfe4b253a"
 dependencies = [
 "arc-swap",
 "aws-credential-types",
@@ -507,9 +503,9 @@ dependencies = [

 [[package]]
 name = "aws-sigv4"
-version = "1.5.1"
+version = "1.5.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "723c2234ad7511ceef63eab016b7ba6ff7c55590fefb96fa8467af014a07309f"
+checksum = "31d955e76ff96acd555bf06fa0fa6d5bf9335fa84ae7c64481b20ae61d231f70"
 dependencies = [
 "aws-credential-types",
 "aws-smithy-http",
@@ -561,9 +557,9 @@ dependencies = [

 [[package]]
 name = "aws-smithy-json"
-version = "0.63.0"
+version = "0.63.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3dc65a121adb4b33729919fcfa14fa36fb33c1555a8f06bb0e2188dbfdc1d9ef"
+checksum = "3385d469edbe8b60cc72002784652b5efca39178192aa9cc4b44c9875c6bdc18"
 dependencies = [
 "aws-smithy-runtime-api",
 "aws-smithy-schema",
@@ -581,9 +577,9 @@ dependencies = [

 [[package]]
 name = "aws-smithy-query"
-version = "0.62.0"
+version = "0.62.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "512346c7212ab7436df2d77a16d976a468ae44a418835511d2a69269810aaf62"
+checksum = "f1d1d71f6562be974caa85442ecd90194c40fdb5df045f182a6c2e872ce95056"
 dependencies = [
 "aws-smithy-runtime-api",
 "aws-smithy-schema",
@@ -594,9 +590,9 @@ dependencies = [

 [[package]]
 name = "aws-smithy-runtime"
-version = "1.14.0"
+version = "1.14.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b82e438d30e02a825d363bd639a9efaed68a8089d86101054b0081e7e0d3e606"
+checksum = "3296253d3a91b3f938a3f2bcce4daebadcb4aa4228153fcec90f9d23532b4484"
 dependencies = [
 "aws-smithy-async",
 "aws-smithy-http",
@@ -619,9 +615,9 @@ dependencies = [

 [[package]]
 name = "aws-smithy-runtime-api"
-version = "1.16.0"
+version = "1.16.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9c054752dd9e4dc73d0b75748c99ac2d0feafbf2f25c7b0516f03a3534161223"
+checksum = "6d881a7b7ad179fd6611680c9de89f716fb00ab40299a9a7b8c6913e8f7511a8"
 dependencies = [
 "aws-smithy-async",
 "aws-smithy-runtime-api-macros",
@@ -648,9 +644,9 @@ dependencies = [

 [[package]]
 name = "aws-smithy-schema"
-version = "0.2.0"
+version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7d56e0a4e53127a632224e43633b0fe045fa9e1e3cfc68b9830f1115e103f910"
+checksum = "e8f395d93304280b64b7632fea798d177e74897fe7f063416ce627cd6fa24829"
 dependencies = [
 "aws-smithy-runtime-api",
 "aws-smithy-types",
@@ -659,9 +655,9 @@ dependencies = [

 [[package]]
 name = "aws-smithy-types"
-version = "1.6.3"
+version = "1.6.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8f94d16e797ec62cd999fc9d5942b48fa7050c3093ddadff48e4d7528d16fcb9"
+checksum = "0b791f3ac597193fe1d08b82366986eb1f5bc31f2ac6c194c0855276116c76cd"
 dependencies = [
 "base64-simd",
 "bytes",
@@ -682,9 +678,9 @@ dependencies = [

 [[package]]
 name = "aws-smithy-xml"
-version = "0.62.0"
+version = "0.62.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ce84f71c72fee2cbbadde6e7d082f5fb466e3a84733855295fa7aafd1b31b7d8"
+checksum = "0b932c8d6dc127fc980eecd78f8694ae9b9551b69a93a7def2a199c1c0033daf"
 dependencies = [
 "aws-smithy-runtime-api",
 "aws-smithy-schema",
@@ -785,9 +781,9 @@ checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"

 [[package]]
 name = "bitflags"
-version = "2.13.1"
+version = "2.13.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b588b76d00fde79687d7646a9b5bdf3cc0f655e0bbd080335a95d7e96f3587da"
+checksum = "3ded4057c258ba199e2d26386d3af3780957ecaee6c4ef4041c6b4b8b97c0b06"

 [[package]]
 name = "blake2"
@@ -930,9 +926,9 @@ checksum = "f5813789573ae815c8b4be58c4428e0e7ae05f0227678ba9de332ded585b9159"

 [[package]]
 name = "cc"
-version = "1.4.5"
+version = "1.4.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "005ec2760ca554fae18df7a11195552ec576cd665632a881bc011d5bb2fd4d80"
+checksum = "54413ede23c2daf518f35156dfde027feb2374004d63bd497f983c8db9c0e313"
 dependencies = [
 "find-msvc-tools",
 "jobserver",
@@ -942,9 +938,9 @@ dependencies = [

 [[package]]
 name = "cfg-if"
-version = "1.0.4"
+version = "1.0.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
+checksum = "4e7648175b45a9a48536d676f68d918270699102aa8dab5496df06904c914600"

 [[package]]
 name = "cfg_aliases"
@@ -1011,9 +1007,9 @@ dependencies = [

 [[package]]
 name = "compression-codecs"
-version = "0.4.40"
+version = "0.4.43"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "100590da849306918656ffbb22576bbdfc1382b50ad10d1d50ec177d3b205fb2"
+checksum = "bef16c47ba2797aa6a909cc37d39911f3a6743811fe7408ac0b0cc0276b656e9"
 dependencies = [
 "brotli",
 "compression-core",
@@ -1170,9 +1166,9 @@ dependencies = [

 [[package]]
 name = "crc32fast"
-version = "1.5.1"
+version = "1.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8498c871161e1742aaa9d52551b2d6ebdd4c3d45a3be423e3728f33b955be550"
+checksum = "01a7799fd6b852db0e61728dde9a204c423b44d689dbd432522543614b490e78"
 dependencies = [
 "cfg-if",
 ]
@@ -1360,7 +1356,7 @@ dependencies = [
 "proc-macro2",
 "quote",
 "strsim",
- "syn 3.0.5",
+ "syn 3.0.6",
 ]

 [[package]]
@@ -1393,7 +1389,7 @@ checksum = "2ac7135c3ef02b2f7833bbeb1be5ba7f966dcde8a87c6b87f65a778d71a02785"
 dependencies = [
 "darling_core 0.24.1",
 "quote",
- "syn 3.0.5",
+ "syn 3.0.6",
 ]

 [[package]]
@@ -1567,7 +1563,7 @@ version = "0.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b035a542cf7abf01f2e3c4d5a7acbaebfefe120ae4efc7bde3df98186e4b8af7"
 dependencies = [
- "bitflags 2.13.1",
+ "bitflags 2.13.2",
 "proc-macro2",
 "proc-macro2-diagnostics",
 "quote",
@@ -1581,7 +1577,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e3b934ddbdcb2abb9f9fc9c30bd47bcc5618b615eea1d334cda5fdf8ff9b072a"
 dependencies = [
 "bigdecimal",
- "bitflags 2.13.1",
+ "bitflags 2.13.2",
 "byteorder",
 "chrono",
 "diesel_derives",
@@ -1676,7 +1672,7 @@ checksum = "c6232dd377dcc64799954cbd3a9bb882e9cdc1308ccd87b1c098f1fb2eaf82a8"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn 3.0.5",
+ "syn 3.0.6",
 ]

 [[package]]
@@ -1920,9 +1916,9 @@ dependencies = [

 [[package]]
 name = "find-msvc-tools"
-version = "0.1.12"
+version = "0.1.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3e0f1c7c3a72c66fd80abe965175f7523475c0489a87d3ff9d6e8c87d87a9d2d"
+checksum = "ef25905e51abafe4dcea6c15fec58c57b601cdbd0ee53d22ea1d3016c587d39b"

 [[package]]
 name = "flate2"
@@ -2040,7 +2036,7 @@ checksum = "9fb9654ba8355388abeb8dcb4fc62f511300867002afc858860463bdd9fe0c44"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn 3.0.5",
+ "syn 3.0.6",
 ]

 [[package]]
@@ -2311,9 +2307,9 @@ checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"

 [[package]]
 name = "hickory-net"
-version = "0.26.2"
+version = "0.26.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "084e7bd6a377435d568f652153e571b50970d7ccc1d1eeec0519f834632287e1"
+checksum = "c480823ed7c2c5d0f09c41020cb6b7c28029ce60ec42dc942158dcf22f8e0a4d"
 dependencies = [
 "async-trait",
 "cfg-if",
@@ -2335,9 +2331,9 @@ dependencies = [

 [[package]]
 name = "hickory-proto"
-version = "0.26.2"
+version = "0.26.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7e2da0694c15b44c6f68a6b05e0233617008c54080e31d6eb848d858a9c5b38d"
+checksum = "12b92608f679a6fa515dd1d15c1ff89443026e391200a2c840c7afcba482893d"
 dependencies = [
 "data-encoding",
 "idna",
@@ -2355,9 +2351,9 @@ dependencies = [

 [[package]]
 name = "hickory-resolver"
-version = "0.26.2"
+version = "0.26.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0e4f9f4603319422d482738f3f6fe5aac03157fdbfed1cd85a3ff45adb09072f"
+checksum = "3f3da5255c95d5a716857d54b5b8f4e8d67c3484d3beaaaae2ce25063b3ba981"
 dependencies = [
 "cfg-if",
 "futures-util",
@@ -2555,7 +2551,7 @@ dependencies = [
 "http 1.5.0",
 "hyper 1.11.1",
 "hyper-util",
- "rustls 0.23.44",
+ "rustls 0.23.45",
 "tokio",
 "tokio-rustls 0.26.5",
 "tower-service",
@@ -2805,9 +2801,9 @@ checksum = "47f142fe24a9c9944451e8349de0a56af5f3e7226dc46f3ed4d4ecc0b85af75e"

 [[package]]
 name = "jiff"
-version = "0.2.35"
+version = "0.2.37"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "668b7183bd07af9a4885f5c35b0cc5c83c4607a913c16b7e17291832910d2dcc"
+checksum = "0ab1baf72f08796de0260609515130699b890ac25f30e610ad894bc5856cafdb"
 dependencies = [
 "defmt",
 "jiff-core",
@@ -2824,18 +2820,19 @@ dependencies = [

 [[package]]
 name = "jiff-core"
-version = "0.1.0"
+version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7feca88439efe53da3754500c1851dedf3cb36c524dd5cf8225cc0794de95d09"
+checksum = "5e52fe76043ccecc9005d2305ebaadf7d7fc0cc89ca6baa10a94d6bc68c7128c"
 dependencies = [
 "defmt",
+ "log",
 ]

 [[package]]
 name = "jiff-static"
-version = "0.2.35"
+version = "0.2.37"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3a69dcb3a21cfb32ce1cd056169337ca284af0766dd766e7878819b251a49204"
+checksum = "378268a1116ad67ae6228701118ac9f491d78fda38a40a1f1a9e1348de6f7212"
 dependencies = [
 "jiff-core",
 "proc-macro2",
@@ -2941,9 +2938,9 @@ dependencies = [

 [[package]]
 name = "jsonwebtoken"
-version = "11.0.0"
+version = "11.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "881733cbc631fc9e472e24447ce32a64bedf2da498d6d8570b08edc87de71f65"
+checksum = "e75fe14a82d81e5f5af639997db37d8b96045938a7ac6ab18cdbe1c7467e05e1"
 dependencies = [
 "base64 0.22.1",
 "ed25519-dalek",
@@ -3011,7 +3008,7 @@ dependencies = [
 "nom 8.0.0",
 "percent-encoding",
 "quoted_printable",
- "rustls 0.23.44",
+ "rustls 0.23.45",
 "rustls-native-certs",
 "serde",
 "socket2 0.6.5",
@@ -3109,7 +3106,7 @@ name = "macros"
 version = "0.1.0"
 dependencies = [
 "quote",
- "syn 3.0.5",
+ "syn 3.0.6",
 ]

 [[package]]
@@ -3267,7 +3264,7 @@ dependencies = [
 "proc-macro2",
 "quote",
 "rustversion",
- "syn 3.0.5",
+ "syn 3.0.6",
 ]

 [[package]]
@@ -3299,7 +3296,7 @@ version = "0.31.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cf20d2fde8ff38632c426f1165ed7436270b44f199fc55284c38276f9db47c3d"
 dependencies = [
- "bitflags 2.13.1",
+ "bitflags 2.13.2",
 "cfg-if",
 "cfg_aliases",
 "libc",
@@ -3379,7 +3376,7 @@ checksum = "e4e98dc3b890f6c23a0f9d3d491a2823d0dea0fa656302a13dd225fa924112a8"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn 3.0.5",
+ "syn 3.0.6",
 ]

 [[package]]
@@ -3485,9 +3482,9 @@ dependencies = [

 [[package]]
 name = "opendal"
-version = "0.59.1"
+version = "0.59.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f950151f9587a51a7bed70a15fa0cff464eae96e41ae7499f97067bdafdf43eb"
+checksum = "9fe43e16d96bed57937eb7c4a28559bf4c5fc4a3951656505d1fdd4f856349b4"
 dependencies = [
 "opendal-core",
 "opendal-service-fs",
@@ -3496,9 +3493,9 @@ dependencies = [

 [[package]]
 name = "opendal-core"
-version = "0.59.1"
+version = "0.59.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a43405d217dfdfb543f58847336d3af672897dd1939bb7dcf314b63cf364f1c9"
+checksum = "de4566a412776e3f65d53dd9fceced5b432a0a9c9a1e8d50ccf58823795e5c5b"
 dependencies = [
 "anyhow",
 "asyncband",
@@ -3522,9 +3519,9 @@ dependencies = [

 [[package]]
 name = "opendal-http-transport-reqwest"
-version = "0.59.1"
+version = "0.59.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "401999057db611e592f883fcf2cbd6754ff37af587deaadd07b8c1398b2b6b06"
+checksum = "f772ce6c137ab43647726116d505a649a88d41928fcd813438eb30b02312bcbb"
 dependencies = [
 "bytes",
 "futures",
@@ -3536,9 +3533,9 @@ dependencies = [

 [[package]]
 name = "opendal-service-fs"
-version = "0.59.1"
+version = "0.59.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fb9caf04d6d38713299dd4abac984b95ab16ee20e1ff09160f495c5a64644083"
+checksum = "a0e7d8974aebd33be899200c9d0d50b2141fd5fa5c462b29e20653e3ddbfe339"
 dependencies = [
 "bytes",
 "log",
@@ -3550,9 +3547,9 @@ dependencies = [

 [[package]]
 name = "opendal-service-s3"
-version = "0.59.1"
+version = "0.59.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "388b1d39b62535c62803754ebef89808859558697366dbedd0299345887ba461"
+checksum = "2942f2d8d3d4953c0e8d07cd1244879628d084948e48ce6b6d808c5938f7858d"
 dependencies = [
 "base64 0.23.1",
 "bytes",
@@ -3606,7 +3603,7 @@ version = "0.10.81"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "77823a27f0babb03091cb9ed9ef80af3b39dbc82f97e8fa530374b7dafd87a45"
 dependencies = [
- "bitflags 2.13.1",
+ "bitflags 2.13.2",
 "cfg-if",
 "foreign-types",
 "libc",
@@ -4060,7 +4057,7 @@ version = "3.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e67ba7e9b2b56446f1d419b1d807906278ffa1a658a8a5d8a39dcb1f5a78614f"
 dependencies = [
- "toml_edit 0.25.13+spec-1.1.0",
+ "toml_edit 0.25.15+spec-1.1.0",
 ]

 [[package]]
@@ -4252,7 +4249,7 @@ version = "11.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "498cd0dc59d73224351ee52a95fee0f1a617a2eae0e7d9d720cc622c73a54186"
 dependencies = [
- "bitflags 2.13.1",
+ "bitflags 2.13.2",
 ]

 [[package]]
@@ -4261,7 +4258,7 @@ version = "0.5.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ed2bf2547551a7053d6fdfafda3f938979645c44812fbfcda098faae3f1a362d"
 dependencies = [
- "bitflags 2.13.1",
+ "bitflags 2.13.2",
 ]

 [[package]]
@@ -4281,7 +4278,7 @@ checksum = "92ecd8964f8453721699a1ed72037b0db49ce2f5a5138486ee89bed6f67cdf3a"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn 3.0.5",
+ "syn 3.0.6",
 ]

 [[package]]
@@ -4424,7 +4421,7 @@ dependencies = [
 "mime",
 "percent-encoding",
 "pin-project-lite",
- "rustls 0.23.44",
+ "rustls 0.23.45",
 "rustls-pki-types",
 "rustls-platform-verifier",
 "serde",
@@ -4668,11 +4665,11 @@ dependencies = [

 [[package]]
 name = "rustix"
-version = "1.1.4"
+version = "1.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b6fe4565b9518b83ef4f91bb47ce29620ca828bd32cb7e408f0062e9930ba190"
+checksum = "891efababe418670775f199f0d233d84843c227a0949a883ce15b37c78d6629d"
 dependencies = [
- "bitflags 2.13.1",
+ "bitflags 2.13.2",
 "errno",
 "libc",
 "linux-raw-sys",
@@ -4693,9 +4690,9 @@ dependencies = [

 [[package]]
 name = "rustls"
-version = "0.23.44"
+version = "0.23.45"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6725596c3f2c3a0aef021139e145d4eafe314a6623e4680ca83852b2c67ab2ba"
+checksum = "0d41d731c7d2f962d1ccc364cec258de3c0e93b38c2fb3ba97ac74513048d634"
 dependencies = [
 "log",
 "once_cell",
@@ -4747,7 +4744,7 @@ dependencies = [
 "jni",
 "log",
 "once_cell",
- "rustls 0.23.44",
+ "rustls 0.23.45",
 "rustls-native-certs",
 "rustls-platform-verifier-android",
 "rustls-webpki 0.103.15",
@@ -4889,7 +4886,7 @@ version = "3.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b7f4bc775c73d9a02cde8bf7b2ec4c9d12743edf609006c7facc23998404cd1d"
 dependencies = [
- "bitflags 2.13.1",
+ "bitflags 2.13.2",
 "core-foundation 0.10.1",
 "core-foundation-sys",
 "libc",
@@ -4959,7 +4956,7 @@ checksum = "e7a5d71263a5a7d47b41f6b3f06ba276f10cc18b0931f1799f710578e2309348"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn 3.0.5",
+ "syn 3.0.6",
 ]

 [[package]]
@@ -5055,7 +5052,7 @@ dependencies = [
 "darling 0.24.1",
 "proc-macro2",
 "quote",
- "syn 3.0.5",
+ "syn 3.0.6",
 ]

 [[package]]
@@ -5195,9 +5192,9 @@ checksum = "0c790de23124f9ab44544d7ac05d60440adc586479ce501c1d6d7da3cd8c9cf5"

 [[package]]
 name = "smallvec"
-version = "1.16.0"
+version = "1.16.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b9be42f50aa861c555654aa3a37f52f4b1074bacf4e48fe0ef7fa584e80f1f0f"
+checksum = "ba467056f1b547ed52077911161fc86985becbc60e8e1857c8a144dab0def891"

 [[package]]
 name = "socket2"
@@ -5324,9 +5321,9 @@ dependencies = [

 [[package]]
 name = "syn"
-version = "3.0.5"
+version = "3.0.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "12df2e0110f65b775f769bb17ef989067a1d931b2eb822bd4346631eeada89f9"
+checksum = "8593e8e72159ed2257d083c7a454a85cbf854f37a0966d8d483aff8c8a3ebcee"
 dependencies = [
 "proc-macro2",
 "quote",
@@ -5353,6 +5350,17 @@ dependencies = [
 "syn 2.0.119",
 ]

+[[package]]
+name = "synstructure"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "901704edd0dfe137f1987838ee4f259e4e063c31371bdb423f7ae38ec6f77f02"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.6",
+]
+
 [[package]]
 name = "syslog"
 version = "7.0.0"
@@ -5371,7 +5379,7 @@ version = "0.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a13f3d0daba03132c0aa9767f98351b3488edc2c100cda2d2ec2b04f3d8d3c8b"
 dependencies = [
- "bitflags 2.13.1",
+ "bitflags 2.13.2",
 "core-foundation 0.9.4",
 "system-configuration-sys",
 ]
@@ -5442,7 +5450,7 @@ checksum = "bc04cd3e1236dd4a98afca4569f2deb3f120e5422a4023be2cb683f8486292af"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn 3.0.5",
+ "syn 3.0.6",
 ]

 [[package]]
@@ -5507,18 +5515,9 @@ dependencies = [

 [[package]]
 name = "tinyvec"
-version = "1.13.2"
+version = "1.13.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4cf0ded5c4e56918d8f8a339e1bb67d038d3bc6d144ac407904015ba2e4cde9b"
-dependencies = [
- "tinyvec_macros",
-]
-
-[[package]]
-name = "tinyvec_macros"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
+checksum = "fd3ca314f692efd6c868f8408f53fe444634a845f96c028b97d35f6a1f79f0ee"

 [[package]]
 name = "tokio"
@@ -5545,7 +5544,7 @@ checksum = "78773a2a397f451582ce068015985c33193cf6dea8b74d2a639fe457b2f07b0e"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn 3.0.5",
+ "syn 3.0.6",
 ]

 [[package]]
@@ -5564,7 +5563,7 @@ version = "0.26.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b0c85f2c3ef0b1cd58b36682f4b17aaa995f0e5db534d85692b4903abce21f67"
 dependencies = [
- "rustls 0.23.44",
+ "rustls 0.23.45",
 "tokio",
 ]

@@ -5674,9 +5673,9 @@ dependencies = [

 [[package]]
 name = "toml_edit"
-version = "0.25.13+spec-1.1.0"
+version = "0.25.15+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6975367e4d2ef766d86af01ffad14b622fecc8d4357a998fbc4deb6e9bacaf9b"
+checksum = "1340ea94a5856333492c9064b02c778b191dd2c853778d9609debdcdfea3a614"
 dependencies = [
 "indexmap 2.14.2",
 "toml_datetime 1.1.1+spec-1.1.0",
@@ -5733,7 +5732,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4cfcf7e2740e6fc6d4d688b4ef00650406bb94adf4731e43c096c3a19fe40840"
 dependencies = [
 "async-compression",
- "bitflags 2.13.1",
+ "bitflags 2.13.2",
 "bytes",
 "futures-core",
 "futures-util",
@@ -5881,9 +5880,9 @@ dependencies = [

 [[package]]
 name = "unicode-ident"
-version = "1.0.24"
+version = "1.0.26"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
+checksum = "d245f478577f809a851594d02313b640fb437e0bb33866753cff937863096954"

 [[package]]
 name = "unicode-segmentation"
@@ -5936,9 +5935,9 @@ checksum = "b6c140620e7ffbb22c2dee59cafe6084a59b5ffc27a8859a5f0d494b5d52b6be"

 [[package]]
 name = "uuid"
-version = "1.26.0"
+version = "1.26.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b5772d71c9be8a8a6ac2117d949c5b224c1b72241bb611d9a3012edcf8af7812"
+checksum = "2ef6dac1e96601b4fb3acccccff2139741fcb757cb9a36089bf5be91cfb285ce"
 dependencies = [
 "getrandom 0.4.3",
 "js-sys",
@@ -6019,7 +6018,7 @@ dependencies = [
 "rocket",
 "rocket_ws",
 "rpassword",
- "rustls 0.23.44",
+ "rustls 0.23.45",
 "semver",
 "serde",
 "serde_json",
@@ -6134,7 +6133,7 @@ dependencies = [
 "bumpalo",
 "proc-macro2",
 "quote",
- "syn 3.0.5",
+ "syn 3.0.6",
 "wasm-bindgen-shared",
 ]

@@ -6612,14 +6611,14 @@ dependencies = [

 [[package]]
 name = "yoke-derive"
-version = "0.8.2"
+version = "0.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "de844c262c8848816172cef550288e7dc6c7b7814b4ee56b3e1553f275f1858e"
+checksum = "33811428bee40dbceb6d545e95754741d17a6aef9a4849f0fd62e2ba4f412a78"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn 2.0.119",
- "synstructure",
+ "syn 3.0.6",
+ "synstructure 0.14.0",
 ]

 [[package]]
@@ -6666,14 +6665,14 @@ dependencies = [

 [[package]]
 name = "zerofrom-derive"
-version = "0.1.7"
+version = "0.1.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "11532158c46691caf0f2593ea8358fed6bbf68a0315e80aae9bd41fbade684a1"
+checksum = "f75b4683f6c7f45248d4d64056a24298c6281e0993356d7d1b4a1a962ef10d4a"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn 2.0.119",
- "synstructure",
+ "syn 3.0.6",
+ "synstructure 0.14.0",
 ]

 [[package]]
@@ -6726,14 +6725,14 @@ checksum = "34df6fc39dbd26ddc9c10e6a2984476e13acce22e64e4487636ef494369225da"
 dependencies = [
 "proc-macro2",
 "quote",
- "syn 3.0.5",
+ "syn 3.0.6",
 ]

 [[package]]
 name = "zlib-rs"
-version = "0.6.7"
+version = "0.6.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "34b31d188d9d685a4f9c7b46d6e36631b07058d2cfe190267adce54dc230bf12"
+checksum = "b268e58e7c693d7c271f93ffc4ba3b380412554231c85bf61ca7af91042a4112"

 [[package]]
 name = "zmij"
@@ -125,11 +125,11 @@ libsqlite3-sys = { version = "0.38.2", optional = true }
 # Crypto-related libraries
 rand = "0.10.2"
 ring = "0.17.14"
-rustls = { version = "0.23.44", features = ["ring", "std"], default-features = false }
+rustls = { version = "0.23.45", features = ["ring", "std"], default-features = false }
 subtle = "2.6.1"

 # UUID generation
-uuid = { version = "1.26.0", features = ["v4"] }
+uuid = { version = "1.26.1", features = ["v4"] }

 # Date and time libraries
 chrono = { version = "0.4.45", default-features = false, features = ["clock", "serde"] }
@@ -143,7 +143,7 @@ job_scheduler_ng = "2.5.0"
 data-encoding = "2.11.1"

 # JWT library
-jsonwebtoken = { version = "11.0.0", default-features = false, features = ["rust_crypto", "use_pem"] }
+jsonwebtoken = { version = "11.1.0", default-features = false, features = ["rust_crypto", "use_pem"] }

 # TOTP library
 totp-lite = "2.0.1"
@@ -201,7 +201,7 @@ reqwest = { version = "0.13.5", default-features = false, features = [
    "socks",
    "system-proxy",
 ] }
-hickory-resolver = "0.26.2"
+hickory-resolver = "0.26.3"

 # Favicon extraction libraries
 html5gum = "0.8.4"
@@ -257,8 +257,8 @@ rpassword = "7.5.4"
 grass_compiler = { version = "0.13.4", default-features = false }

 # File are accessed through Apache OpenDAL
-opendal = { version = "0.59.1", default-features = false, features = ["services-fs"] }
-opendal-http-transport-reqwest = { version = "0.59.1", default-features = false, features = ["rustls-no-provider"], optional = true }
+opendal = { version = "0.59.2", default-features = false, features = ["services-fs"] }
+opendal-http-transport-reqwest = { version = "0.59.2", default-features = false, features = ["rustls-no-provider"], optional = true }

 # For retrieving AWS credentials, including temporary SSO credentials
 aws-config = { version = "1.12.0", optional = true, default-features = false, features = [
@@ -268,7 +268,7 @@ aws-config = { version = "1.12.0", optional = true, default-features = false, fe
    "sso",
 ] }
 aws-credential-types = { version = "1.3.0", optional = true }
-aws-smithy-runtime-api = { version = "1.16.0", optional = true }
+aws-smithy-runtime-api = { version = "1.16.2", optional = true }
 http = { version = "1.5.0", optional = true }
 reqsign-aws-v4 = { version = "3.3.0", optional = true }
 reqsign-core = { version = "3.3.1", optional = true }
@@ -101,9 +101,17 @@ RUN . /env-cargo && \
    # https://github.com/tonistiigi/xx/pull/108#issuecomment-3700635977
    # https://github.com/dani-garcia/vaultwarden/discussions/7522
    if xx-info is-cross; then \
-        XX_RUSTFLAGS="-C link-arg=-Wl,-rpath-link,/usr/lib/$(xx-info triple)"; \
-        export XX_RUSTFLAGS; \
+        XX_RUSTFLAGS="-Clink-arg=-Wl,-rpath-link,/usr/lib/$(xx-info triple)"; \
    fi && \
+    # Debian's GCC adds a special fix for cortex-a53 arch's which gets losts when using xx-cargo, which uses clang
+    # Checking if the arch is arm64 and adding this extra link-arg should cause this fix to be applied
+    # This should fix issues reported when running on a RPi3 which is a Cortex-A35 chip
+    # See: https://salsa.debian.org/toolchain-team/gcc/-/blob/master/debian/rules2?pow_referer=#L543-548
+    # See: https://github.com/dani-garcia/vaultwarden/issues/7754
+    if [ "$(xx-info arch)" = "arm64" ]; then \
+        XX_RUSTFLAGS="${XX_RUSTFLAGS} -Clink-arg=-Wl,--fix-cortex-a53-843419"; \
+    fi && \
+    export XX_RUSTFLAGS && \
    PKG_CONFIG="$(command -v "$(xx-info)-pkg-config")" xx-cargo build --features ${DB} --profile "${CARGO_PROFILE}" && \
    find . -not -path "./target*" -delete

@@ -123,9 +131,17 @@ RUN . /env-cargo && \
    # https://github.com/tonistiigi/xx/pull/108#issuecomment-3700635977
    # https://github.com/dani-garcia/vaultwarden/discussions/7522
    if xx-info is-cross; then \
-        XX_RUSTFLAGS="-C link-arg=-Wl,-rpath-link,/usr/lib/$(xx-info triple)"; \
-        export XX_RUSTFLAGS; \
+        XX_RUSTFLAGS="-Clink-arg=-Wl,-rpath-link,/usr/lib/$(xx-info triple)"; \
    fi && \
+    # Debian's GCC adds a special fix for cortex-a53 arch's which gets losts when using xx-cargo, which uses clang
+    # Checking if the arch is arm64 and adding this extra link-arg should cause this fix to be applied
+    # This should fix issues reported when running on a RPi3 which is a Cortex-A35 chip
+    # See: https://salsa.debian.org/toolchain-team/gcc/-/blob/master/debian/rules2?pow_referer=#L543-548
+    # See: https://github.com/dani-garcia/vaultwarden/issues/7754
+    if [ "$(xx-info arch)" = "arm64" ]; then \
+        XX_RUSTFLAGS="${XX_RUSTFLAGS} -Clink-arg=-Wl,--fix-cortex-a53-843419"; \
+    fi && \
+    export XX_RUSTFLAGS && \
    PKG_CONFIG="$(command -v "$(xx-info)-pkg-config")" xx-cargo build --features ${DB} --profile "${CARGO_PROFILE}" && \
    if [ "${CARGO_PROFILE}" = "dev" ] ; then \
        ln -vfsr "/app/target/${CARGO_TARGET}/debug" /app/target/final ; \
@@ -32,9 +32,17 @@
    # https://github.com/tonistiigi/xx/pull/108#issuecomment-3700635977
    # https://github.com/dani-garcia/vaultwarden/discussions/7522
    if xx-info is-cross; then \
-        XX_RUSTFLAGS="-C link-arg=-Wl,-rpath-link,/usr/lib/$(xx-info triple)"; \
-        export XX_RUSTFLAGS; \
+        XX_RUSTFLAGS="-Clink-arg=-Wl,-rpath-link,/usr/lib/$(xx-info triple)"; \
    fi && \
+    # Debian's GCC adds a special fix for cortex-a53 arch's which gets losts when using xx-cargo, which uses clang
+    # Checking if the arch is arm64 and adding this extra link-arg should cause this fix to be applied
+    # This should fix issues reported when running on a RPi3 which is a Cortex-A35 chip
+    # See: https://salsa.debian.org/toolchain-team/gcc/-/blob/master/debian/rules2?pow_referer=#L543-548
+    # See: https://github.com/dani-garcia/vaultwarden/issues/7754
+    if [ "$(xx-info arch)" = "arm64" ]; then \
+        XX_RUSTFLAGS="${XX_RUSTFLAGS} -Clink-arg=-Wl,--fix-cortex-a53-843419"; \
+    fi && \
+    export XX_RUSTFLAGS && \
    PKG_CONFIG="$(command -v "$(xx-info)-pkg-config")" xx-cargo build --features ${DB} --profile "${CARGO_PROFILE}"
 {%- endmacro %}
 FROM --platform=linux/amd64 docker.io/vaultwarden/web-vault@{{ vault_image_digest }} AS vault
@@ -14,7 +14,7 @@ proc-macro = true

 [dependencies]
 quote = "1.0.47"
-syn = "3.0.5"
+syn = "3.0.6"

 [lints]
 workspace = true
@@ -0,0 +1 @@
+ALTER TABLE users ADD COLUMN key_id TEXT;
@@ -0,0 +1 @@
+ALTER TABLE users ADD COLUMN key_id TEXT;
@@ -0,0 +1 @@
+ALTER TABLE users ADD COLUMN key_id TEXT;
@@ -0,0 +1 @@
+ALTER TABLE users ADD COLUMN key_id TEXT;
@@ -508,6 +508,7 @@ async fn enable_user(user_id: UserId, _token: AdminToken, conn: DbConn) -> Empty
 async fn remove_2fa(user_id: UserId, token: AdminToken, conn: DbConn) -> EmptyResult {
    let mut user = get_user_or_404(&user_id, &conn).await?;
    TwoFactor::delete_all_by_user(&user.uuid, &conn).await?;
+    Device::clear_twofactor_remember_by_user(&user.uuid, &conn).await?;
    two_factor::enforce_2fa_policy(&user, &ACTING_ADMIN_USER.into(), 14, &token.ip.ip, &conn).await?;
    user.totp_recover = None;
    user.save(&conn).await
@@ -905,23 +906,23 @@ mod tests {
    fn validate_web_vault_compare() {
        // web_vault_compare(active, latest)
        // Test normal versions
-        assert!(web_vault_compare("2025.12.0", "2025.12.1") == -1);
-        assert!(web_vault_compare("2025.12.1", "2025.12.1") == 0);
-        assert!(web_vault_compare("2025.12.2", "2025.12.1") == 1);
+        assert_eq!(web_vault_compare("2025.12.0", "2025.12.1"), -1);
+        assert_eq!(web_vault_compare("2025.12.1", "2025.12.1"), 0);
+        assert_eq!(web_vault_compare("2025.12.2", "2025.12.1"), 1);

        // Test patched/+build.n versions
        // Newer latest version
-        assert!(web_vault_compare("2025.12.0+build.1", "2025.12.1") == -1);
-        assert!(web_vault_compare("2025.12.1", "2025.12.1+build.1") == -1);
-        assert!(web_vault_compare("2025.12.0+build.1", "2025.12.1+build.1") == -1);
-        assert!(web_vault_compare("2025.12.1+build.1", "2025.12.1+build.2") == -1);
+        assert_eq!(web_vault_compare("2025.12.0+build.1", "2025.12.1"), -1);
+        assert_eq!(web_vault_compare("2025.12.1", "2025.12.1+build.1"), -1);
+        assert_eq!(web_vault_compare("2025.12.0+build.1", "2025.12.1+build.1"), -1);
+        assert_eq!(web_vault_compare("2025.12.1+build.1", "2025.12.1+build.2"), -1);
        // Equal versions
-        assert!(web_vault_compare("2025.12.1+build.1", "2025.12.1+build.1") == 0);
-        assert!(web_vault_compare("2025.12.2+build.2", "2025.12.2+build.2") == 0);
+        assert_eq!(web_vault_compare("2025.12.1+build.1", "2025.12.1+build.1"), 0);
+        assert_eq!(web_vault_compare("2025.12.2+build.2", "2025.12.2+build.2"), 0);
        // Newer active version
-        assert!(web_vault_compare("2025.12.1+build.1", "2025.12.1") == 1);
-        assert!(web_vault_compare("2025.12.2", "2025.12.1+build.1") == 1);
-        assert!(web_vault_compare("2025.12.2+build.1", "2025.12.1+build.1") == 1);
-        assert!(web_vault_compare("2025.12.1+build.3", "2025.12.1+build.2") == 1);
+        assert_eq!(web_vault_compare("2025.12.1+build.1", "2025.12.1"), 1);
+        assert_eq!(web_vault_compare("2025.12.2", "2025.12.1+build.1"), 1);
+        assert_eq!(web_vault_compare("2025.12.2+build.1", "2025.12.1+build.1"), 1);
+        assert_eq!(web_vault_compare("2025.12.1+build.3", "2025.12.1+build.2"), 1);
    }
 }
@@ -21,8 +21,9 @@ use crate::{
        DbConn, DbPool,
        models::{
            AuthRequest, AuthRequestId, Cipher, CipherId, Device, DeviceId, DeviceType, DeviceWithAuthRequest,
-            EmergencyAccess, EmergencyAccessId, EventType, Folder, FolderId, Invitation, Membership, MembershipId,
-            OrgPolicy, OrgPolicyType, Organization, OrganizationId, Send, SendId, User, UserId, UserKdfType,
+            EmergencyAccess, EmergencyAccessId, EventType, Folder, FolderId, Invitation, KeyId, Membership,
+            MembershipId, OrgPolicy, OrgPolicyType, Organization, OrganizationId, Send, SendId, User, UserId,
+            UserKdfType,
        },
    },
    mail,
@@ -31,7 +32,7 @@ use crate::{

 use super::{
    ciphers::{CipherData, update_cipher_from_data},
-    sends::{SendData, update_send_from_data},
+    sends::SendData,
 };

 pub fn routes() -> Vec<rocket::Route> {
@@ -46,6 +47,7 @@ pub fn routes() -> Vec<rocket::Route> {
        post_set_password,
        post_kdf,
        post_rotatekey,
+        post_user_key,
        post_sstamp,
        post_email_token,
        post_email,
@@ -57,7 +59,6 @@ pub fn routes() -> Vec<rocket::Route> {
        delete_account,
        revision_date,
        password_hint,
-        post_prelogin,
        verify_password,
        post_api_key,
        rotate_api_key,
@@ -104,11 +105,8 @@ pub struct RegisterData {

    master_password_hint: Option<String>,

-    name: Option<String>,
-
    organization_user_id: Option<MembershipId>,

-    // Used only from the register/finish endpoint
    email_verification_token: Option<String>,
    accept_emergency_access_id: Option<EmergencyAccessId>,
    accept_emergency_access_invite_token: Option<String>,
@@ -161,7 +159,9 @@ struct RegisterDataOld {
 #[derive(Debug, Deserialize)]
 #[serde(rename_all = "camelCase")]
 struct RegisterDataCur {
+    #[serde(alias = "MasterPasswordAuthentication")]
    master_password_authentication: MasterPasswordAuthentication,
+    #[serde(alias = "MasterPasswordUnlock")]
    master_password_unlock: MasterPasswordUnlock,
 }

@@ -195,10 +195,12 @@ struct KeysData {
 #[derive(Debug, Deserialize)]
 #[serde(rename_all = "camelCase")]
 pub struct MasterPasswordAuthentication {
+    #[serde(alias = "Kdf")]
    kdf: KDFData,
+    #[serde(alias = "Salt")]
    salt: String,

-    #[serde(alias = "masterPasswordAuthenticationHash")]
+    #[serde(alias = "masterPasswordAuthenticationHash", alias = "MasterPasswordAuthenticationHash")]
    hash: String,
 }

@@ -255,12 +257,11 @@ async fn is_email_2fa_required(member_id: Option<MembershipId>, conn: &DbConn) -
    false
 }

-pub async fn register(data: Json<RegisterData>, email_verification: bool, conn: DbConn) -> JsonResult {
-    let mut data: RegisterData = data.into_inner();
+pub async fn register(data: Json<RegisterData>, conn: DbConn) -> JsonResult {
+    let data: RegisterData = data.into_inner();
    let email = data.email.to_lowercase();

-    let mut email_verified = false;
-
+    let mut name = None;
    let mut pending_emergency_access = None;

    if data.unprocessable() {
@@ -268,69 +269,65 @@ pub async fn register(data: Json<RegisterData>, email_verification: bool, conn:
    }

    // First, validate the provided verification tokens
-    if email_verification {
-        match (
-            &data.email_verification_token,
-            &data.accept_emergency_access_id,
-            &data.accept_emergency_access_invite_token,
-            &data.organization_user_id,
-            &data.org_invite_token,
-        ) {
-            // Normal user registration, when email verification is required
-            (Some(email_verification_token), None, None, None, None) => {
-                let claims = crate::auth::decode_register_verify(email_verification_token)?;
-                if claims.sub != data.email {
-                    err!("Email verification token does not match email");
-                }
-
-                // During this call we don't get the name, so extract it from the claims
-                if claims.name.is_some() {
-                    data.name = claims.name;
-                }
-                email_verified = claims.verified;
-            }
-            // Emergency access registration
-            (None, Some(accept_emergency_access_id), Some(accept_emergency_access_invite_token), None, None) => {
-                if !CONFIG.emergency_access_allowed() {
-                    err!("Emergency access is not enabled.")
-                }
-
-                let claims = crate::auth::decode_emergency_access_invite(accept_emergency_access_invite_token)?;
-
-                if claims.email != data.email {
-                    err!("Claim email does not match email")
-                }
-                if &claims.emer_id != accept_emergency_access_id {
-                    err!("Claim emer_id does not match accept_emergency_access_id")
-                }
-
-                pending_emergency_access = Some((accept_emergency_access_id, claims));
-                email_verified = true;
-            }
-            // Org invite
-            (None, None, None, Some(organization_user_id), Some(org_invite_token)) => {
-                let claims = decode_invite(org_invite_token)?;
-
-                if claims.email != data.email {
-                    err!("Claim email does not match email")
-                }
-
-                if &claims.member_id != organization_user_id {
-                    err!("Claim org_user_id does not match organization_user_id")
-                }
-
-                email_verified = true;
+    let mut email_verified = match (
+        &data.email_verification_token,
+        &data.accept_emergency_access_id,
+        &data.accept_emergency_access_invite_token,
+        &data.organization_user_id,
+        &data.org_invite_token,
+    ) {
+        // Normal user registration, when email verification is required
+        (Some(email_verification_token), None, None, None, None) => {
+            let claims = crate::auth::decode_register_verify(email_verification_token)?;
+            if claims.sub != data.email {
+                err!("Email verification token does not match email");
            }

-            _ => {
-                err!("Registration is missing required parameters")
-            }
+            // During this call we don't get the name, so extract it from the claims
+            name = claims.name;
+            claims.verified
        }
-    }
+        // Emergency access registration
+        (None, Some(accept_emergency_access_id), Some(accept_emergency_access_invite_token), None, None) => {
+            if !CONFIG.emergency_access_allowed() {
+                err!("Emergency access is not enabled.")
+            }
+
+            let claims = crate::auth::decode_emergency_access_invite(accept_emergency_access_invite_token)?;
+
+            if claims.email != data.email {
+                err!("Claim email does not match email")
+            }
+            if &claims.emer_id != accept_emergency_access_id {
+                err!("Claim emer_id does not match accept_emergency_access_id")
+            }
+
+            pending_emergency_access = Some((accept_emergency_access_id, claims));
+            true
+        }
+        // Org invite
+        (None, None, None, Some(organization_user_id), Some(org_invite_token)) => {
+            let claims = decode_invite(org_invite_token)?;
+
+            if claims.email != data.email {
+                err!("Claim email does not match email")
+            }
+
+            if &claims.member_id != organization_user_id {
+                err!("Claim org_user_id does not match organization_user_id")
+            }
+
+            true
+        }
+
+        _ => {
+            err!("Registration is missing required parameters")
+        }
+    };

    // Check if the length of the username exceeds 50 characters (Same is Upstream Bitwarden)
    // This also prevents issues with very long usernames causing to large JWT's. See #2419
-    if let Some(ref name) = data.name
+    if let Some(ref name) = name
        && name.len() > 50
    {
        err!("The field Name must be a string with a maximum length of 50.");
@@ -392,7 +389,7 @@ pub async fn register(data: Json<RegisterData>, email_verification: bool, conn:
    user.password_hint = password_hint;

    // Add extra fields if present
-    if let Some(name) = data.name {
+    if let Some(name) = name {
        user.name = name;
    }

@@ -430,8 +427,7 @@ pub async fn register(data: Json<RegisterData>, email_verification: bool, conn:
    }

    Ok(Json(json!({
-      "object": "register",
-      "captchaBypassToken": "",
+      "object": "registerFinish",
    })))
 }

@@ -440,7 +436,7 @@ async fn post_set_password(data: Json<SetPasswordData>, headers: Headers, conn:
    let data: SetPasswordData = data.into_inner();
    let mut user = headers.user;

-    if user.private_key.is_some() {
+    if user.private_key.is_some() || !user.password_hash.is_empty() {
        err!("Account already initialized, cannot set password")
    }

@@ -494,7 +490,6 @@ async fn post_set_password(data: Json<SetPasswordData>, headers: Headers, conn:

    Ok(Json(json!({
      "object": "set-password",
-      "captchaBypassToken": "",
    })))
 }

@@ -579,6 +574,10 @@ async fn post_keys(data: Json<KeysData>, headers: Headers, conn: DbConn) -> Json

    let mut user = headers.user;

+    if user.private_key.is_some() || user.public_key.is_some() {
+        err!("User has existing keypair")
+    }
+
    user.private_key = Some(data.encrypted_private_key);
    user.public_key = Some(data.public_key);

@@ -700,8 +699,11 @@ fn set_kdf_data(user: &mut User, data: &KDFData) -> EmptyResult {
 #[derive(Deserialize)]
 #[serde(rename_all = "camelCase")]
 struct AuthenticationData {
+    #[serde(alias = "Salt")]
    salt: String,
+    #[serde(alias = "Kdf")]
    kdf: KDFData,
+    #[serde(alias = "MasterPasswordAuthenticationHash")]
    master_password_authentication_hash: String,
 }

@@ -980,11 +982,13 @@ async fn post_rotatekey(data: Json<KeyData>, headers: Headers, conn: DbConn, nt:

    // Update send data
    for send_data in data.account_data.sends {
-        let Some(send) = existing_sends.iter_mut().find(|s| &s.uuid == send_data.id.as_ref().unwrap()) else {
+        let Some(send) = send_data.id.as_ref().and_then(|id| existing_sends.iter_mut().find(|s| &s.uuid == id)) else {
            err!("Send doesn't exist")
        };

-        update_send_from_data(send, send_data, &headers, &conn, &nt, UpdateType::None).await?;
+        // Like upstream, only the key changes on rotation
+        send.akey = send_data.key;
+        send.save(&conn).await?;
    }

    // Update cipher data
@@ -1025,6 +1029,23 @@ async fn post_rotatekey(data: Json<KeyData>, headers: Headers, conn: DbConn, nt:
    save_result
 }

+#[derive(Deserialize)]
+#[serde(rename_all = "camelCase")]
+struct KeyIdData {
+    user_key_id: KeyId,
+}
+
+#[post("/accounts/key-management/user-key-id", data = "<data>")]
+async fn post_user_key(data: Json<KeyIdData>, headers: Headers, conn: DbConn) -> EmptyResult {
+    let mut user = headers.user;
+    if user.key_id.is_some() {
+        err_code!("Unexpected data", Status::UnprocessableEntity.code);
+    }
+
+    user.key_id = Some(data.into_inner().user_key_id);
+    user.save(&conn).await
+}
+
 #[post("/accounts/security-stamp", data = "<data>")]
 async fn post_sstamp(data: Json<PasswordOrOtpData>, headers: Headers, conn: DbConn, nt: Notify<'_>) -> EmptyResult {
    let data: PasswordOrOtpData = data.into_inner();
@@ -1339,11 +1360,6 @@ pub struct PreloginData {
    email: String,
 }

-#[post("/accounts/prelogin", data = "<data>")]
-async fn post_prelogin(data: Json<PreloginData>, ip: ClientIp, conn: DbConn) -> JsonResult {
-    prelogin(data, ip, conn).await
-}
-
 pub async fn prelogin(data: Json<PreloginData>, ip: ClientIp, conn: DbConn) -> JsonResult {
    crate::ratelimit::check_limit_unauthenticated(&ip.ip)?;

@@ -1835,3 +1851,62 @@ pub async fn purge_auth_requests(pool: DbPool) {
        error!("Failed to get DB connection while purging auth requests");
    }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_register_data_current_format() {
+        // Web and iOS since the master password authentication/unlock split
+        let data: RegisterData = serde_json::from_str(
+            r#"{
+                "email": "user@example.com",
+                "emailVerificationToken": "token",
+                "userAsymmetricKeys": {"publicKey": "pub", "encryptedPrivateKey": "priv"},
+                "masterPasswordAuthentication": {
+                    "kdf": {"kdfType": 0, "iterations": 600000},
+                    "salt": "user@example.com",
+                    "masterPasswordAuthenticationHash": "hash"
+                },
+                "masterPasswordUnlock": {
+                    "kdf": {"kdfType": 0, "iterations": 600000},
+                    "salt": "user@example.com",
+                    "masterKeyWrappedUserKey": "key"
+                }
+            }"#,
+        )
+        .unwrap();
+
+        assert!(!data.unprocessable());
+        assert_eq!(data.hash(), "hash");
+        assert_eq!(data.key(), "key");
+        assert_eq!(data.kdf().kdf_iterations, 600_000);
+        assert!(data.keys.is_some());
+        assert_eq!(data.email_verification_token.as_deref(), Some("token"));
+    }
+
+    #[test]
+    fn test_register_data_flat_format() {
+        // Android before 2026.9.0
+        let data: RegisterData = serde_json::from_str(
+            r#"{
+                "email": "user@example.com",
+                "emailVerificationToken": "token",
+                "masterPasswordHash": "hash",
+                "masterPasswordHint": null,
+                "userSymmetricKey": "key",
+                "userAsymmetricKeys": {"publicKey": "pub", "encryptedPrivateKey": "priv"},
+                "kdf": 0,
+                "kdfIterations": 600000
+            }"#,
+        )
+        .unwrap();
+
+        assert!(!data.unprocessable());
+        assert_eq!(data.hash(), "hash");
+        assert_eq!(data.key(), "key");
+        assert_eq!(data.kdf().kdf_iterations, 600_000);
+        assert!(data.keys.is_some());
+    }
+}
@@ -6,6 +6,7 @@ use rocket::{
    Route,
    form::{Form, FromForm},
    fs::TempFile,
+    http::Status,
    serde::json::Json,
 };
 use serde_json::Value;
@@ -21,8 +22,8 @@ use crate::{
        DbConn, DbPool,
        models::{
            Archive, Attachment, AttachmentId, Cipher, CipherId, Collection, CollectionCipher, CollectionGroup,
-            CollectionId, CollectionUser, EventType, Favorite, Folder, FolderCipher, FolderId, Group, Membership,
-            MembershipType, OrgPolicy, OrgPolicyType, OrganizationId, RepromptType, Send, UserId,
+            CollectionId, CollectionUser, EventType, Favorite, Folder, FolderCipher, FolderId, Group, KeyId,
+            Membership, MembershipType, OrgPolicy, OrgPolicyType, OrganizationId, RepromptType, Send, UserId,
        },
    },
    util::{NumberOrString, deser_opt_nonempty_str, save_temp_file},
@@ -161,6 +162,12 @@ async fn sync(data: SyncData, headers: Headers, client_version: Option<ClientVer
    let policies_json: Vec<Value> =
        OrgPolicy::find_confirmed_by_user(&headers.user.uuid, &conn).await.iter().map(OrgPolicy::to_json).collect();

+    let policies_new_json: Vec<Value> = OrgPolicy::find_accepted_and_confirmed_by_user(&headers.user.uuid, &conn)
+        .await
+        .iter()
+        .map(OrgPolicy::to_json)
+        .collect();
+
    let domains_json = if data.exclude_domains {
        Value::Null
    } else {
@@ -193,11 +200,13 @@ async fn sync(data: SyncData, headers: Headers, client_version: Option<ClientVer
        "folders": folders_json,
        "collections": collections_json,
        "policies": policies_json,
+        "policiesNew": policies_new_json,
        "ciphers": ciphers_json,
        "domains": domains_json,
        "sends": sends_json,
        "userDecryption": {
            "masterPasswordUnlock": master_password_unlock,
+            "userKeyId": headers.user.key_id,
        },
        "object": "sync"
    })))
@@ -260,12 +269,19 @@ pub struct CipherData {

    key: Option<String>,

+    pub encrypted_for: UserId, // Added in web-v2025.6.0
+    // Added in web-v2025.8.1, Optional for compat
+    pub encrypted_by_key_id: Option<KeyId>,
+
    /*
    Login = 1,
    SecureNote = 2,
    Card = 3,
    Identity = 4,
    SshKey = 5
+    BankAccount = 6
+    DriversLicense = 7
+    Passport = 8
    */
    pub r#type: i32,
    pub name: String,
@@ -278,6 +294,9 @@ pub struct CipherData {
    card: Option<Value>,
    identity: Option<Value>,
    ssh_key: Option<Value>,
+    bank_account: Option<Value>,
+    drivers_license: Option<Value>,
+    passport: Option<Value>,

    favorite: Option<bool>,
    reprompt: Option<i32>,
@@ -333,6 +352,10 @@ async fn post_ciphers_create(
 ) -> JsonResult {
    let mut data: ShareCipherData = data.into_inner();

+    if data.cipher.encrypted_for != headers.user.uuid {
+        err_code!("Invalid user cipher", Status::UnprocessableEntity.code);
+    }
+
    // This check is usually only needed in update_cipher_from_data(), but we
    // need it here as well to avoid creating an empty cipher in the call to
    // cipher.save() below.
@@ -362,6 +385,17 @@ async fn post_ciphers_create(
 async fn post_ciphers(data: Json<CipherData>, headers: Headers, conn: DbConn, nt: Notify<'_>) -> JsonResult {
    let mut data: CipherData = data.into_inner();

+    if data.encrypted_for != headers.user.uuid {
+        err_code!("Invalid user cipher", Status::UnprocessableEntity.code);
+    }
+
+    if let Some(cipher_key_id) = &data.encrypted_by_key_id
+        && let Some(user_key_id) = &headers.user.key_id
+        && cipher_key_id != user_key_id
+    {
+        err_code!("Invalid key cipher", Status::UnprocessableEntity.code);
+    }
+
    // The web/browser clients set this field to null as expected, but the
    // mobile clients seem to set the invalid value `0001-01-01T00:00:00`,
    // which results in a warning message being logged. This field isn't
@@ -510,6 +544,9 @@ pub async fn update_cipher_from_data(
        3 => data.card,
        4 => data.identity,
        5 => data.ssh_key,
+        6 => data.bank_account,
+        7 => data.drivers_license,
+        8 => data.passport,
        _ => err!("Invalid type"),
    };

@@ -1832,7 +1869,7 @@ async fn delete_cipher_by_uuid(
 #[derive(Deserialize)]
 #[serde(rename_all = "camelCase")]
 struct CipherIdsData {
-    ids: Vec<CipherId>,
+    ids: HashSet<CipherId>,
 }

 async fn delete_multiple_ciphers(
@@ -2143,8 +2180,15 @@ impl CipherSyncData {
            }
        }

+        // Generate a HashMap with the Organization UUID as key and the Membership record
+        let members: HashMap<OrganizationId, Membership> = Membership::find_confirmed_by_user(user_id, conn)
+            .await
+            .into_iter()
+            .map(|m| (m.org_uuid.clone(), m))
+            .collect();
+
        // Generate a list of Cipher UUID's containing a Vec with one or more Attachment records
-        let orgs = Membership::get_orgs_by_user(user_id, conn).await;
+        let orgs: Vec<OrganizationId> = members.keys().cloned().collect();
        let attachments = Attachment::find_all_by_user_and_orgs(user_id, &orgs, conn).await;
        let mut cipher_attachments: HashMap<CipherId, Vec<Attachment>> = HashMap::with_capacity(attachments.len());
        for attachment in attachments {
@@ -2159,13 +2203,6 @@ impl CipherSyncData {
            cipher_collections.entry(cipher).or_default().push(collection);
        }

-        // Generate a HashMap with the Organization UUID as key and the Membership record
-        let members: HashMap<OrganizationId, Membership> = Membership::find_confirmed_by_user(user_id, conn)
-            .await
-            .into_iter()
-            .map(|m| (m.org_uuid.clone(), m))
-            .collect();
-
        // Generate a HashMap with the User_Collections UUID as key and the CollectionUser record
        let user_collections: HashMap<CollectionId, CollectionUser> = CollectionUser::find_by_user(user_id, conn)
            .await
@@ -199,6 +199,26 @@ async fn post_events_collect(data: Json<Vec<EventCollection>>, headers: Headers,
                    .await;
                }
            }
+            // Only the vault notification banner click is accepted from clients. The rest of
+            // the 1500..=1599 range is written server-side and must not be forgeable by a client.
+            t if t == EventType::OrganizationUserNotificationBannerActionClicked as i32 => {
+                if let Some(org_id) = &event.organization_id
+                    && let Some(membership) =
+                        Membership::find_confirmed_by_user_and_org(&headers.user.uuid, org_id, &conn).await
+                {
+                    log_event_impl(
+                        event.r#type,
+                        &membership.uuid,
+                        org_id,
+                        &headers.user.uuid,
+                        headers.device.atype,
+                        Some(event_date),
+                        &headers.ip.ip,
+                        &conn,
+                    )
+                    .await;
+                }
+            }
            _ => {
                // The cipher determines the organization the event is logged to, so make sure the
                // user can actually access it instead of trusting the provided cipher uuid.
@@ -15,10 +15,10 @@ use crate::{
    db::{
        DbConn,
        models::{
-            Cipher, CipherId, Collection, CollectionCipher, CollectionGroup, CollectionId, CollectionUser, EventType,
-            Group, GroupId, GroupUser, Invitation, Membership, MembershipId, MembershipStatus, MembershipType,
-            OrgPolicy, OrgPolicyType, Organization, OrganizationApiKey, OrganizationId, TwoFactor, TwoFactorType, User,
-            UserId,
+            Cipher, CipherId, Collection, CollectionCipher, CollectionGroup, CollectionId, CollectionUser, Device,
+            EventType, Group, GroupId, GroupUser, Invitation, Membership, MembershipId, MembershipStatus,
+            MembershipType, OrgPolicy, OrgPolicyType, Organization, OrganizationApiKey, OrganizationId, TwoFactor,
+            TwoFactorType, User, UserId,
        },
    },
    mail,
@@ -31,7 +31,6 @@ pub fn routes() -> Vec<Route> {
        get_organization,
        create_organization,
        delete_organization,
-        post_delete_organization,
        leave_organization,
        get_user_collections,
        get_org_collections,
@@ -39,13 +38,10 @@ pub fn routes() -> Vec<Route> {
        get_org_collection_detail,
        get_collection_users,
        put_organization,
-        post_organization,
        post_organization_collections,
        post_bulk_access_collections,
-        post_organization_collection_update,
        put_organization_collection_update,
        delete_organization_collection,
-        post_organization_collection_delete,
        bulk_delete_organization_collections,
        post_bulk_collections,
        get_org_details,
@@ -60,7 +56,6 @@ pub fn routes() -> Vec<Route> {
        get_org_user_mini_details,
        get_user,
        edit_member,
-        put_member,
        delete_member,
        bulk_delete_member,
        post_org_import,
@@ -70,7 +65,6 @@ pub fn routes() -> Vec<Route> {
        get_master_password_policy,
        get_policy,
        put_policy,
-        put_policy_vnext,
        get_plans,
        post_org_keys,
        get_organization_keys,
@@ -86,22 +80,16 @@ pub fn routes() -> Vec<Route> {
        post_groups,
        get_group,
        put_group,
-        post_group,
        get_group_details,
        delete_group,
-        post_delete_group,
        bulk_delete_groups,
        get_group_members,
-        put_group_members,
-        post_delete_group_member,
        put_reset_password_enrollment,
        get_reset_password_details,
-        put_reset_password,
        put_recover_account,
        get_org_export,
        post_api_key,
        rotate_api_key,
-        get_billing_metadata,
        get_billing_warnings,
        get_auto_enroll_status,
        get_self_host_billing_metadata,
@@ -245,16 +233,6 @@ async fn delete_organization(
    }
 }

-#[post("/organizations/<org_id>/delete", data = "<data>")]
-async fn post_delete_organization(
-    org_id: OrganizationId,
-    data: Json<PasswordOrOtpData>,
-    headers: OwnerHeaders,
-    conn: DbConn,
-) -> EmptyResult {
-    delete_organization(org_id, data, headers, conn).await
-}
-
 #[post("/organizations/<org_id>/leave")]
 async fn leave_organization(org_id: OrganizationId, headers: OrgMemberHeaders, conn: DbConn) -> EmptyResult {
    if headers.membership.status != MembershipStatus::Confirmed as i32 {
@@ -300,16 +278,6 @@ async fn put_organization(
    headers: OwnerHeaders,
    data: Json<OrganizationUpdateData>,
    conn: DbConn,
-) -> JsonResult {
-    post_organization(org_id, headers, data, conn).await
-}
-
-#[post("/organizations/<org_id>", data = "<data>")]
-async fn post_organization(
-    org_id: OrganizationId,
-    headers: OwnerHeaders,
-    data: Json<OrganizationUpdateData>,
-    conn: DbConn,
 ) -> JsonResult {
    if org_id != headers.org_id {
        err!("Organization not found", "Organization id's do not match");
@@ -415,8 +383,9 @@ async fn get_org_collections_details(org_id: OrganizationId, headers: ManagerHea
    let col_users = CollectionUser::find_by_organization_swap_user_uuid_with_member_uuid(&org_id, &conn).await;
    // Generate a HashMap to get the correct MembershipType per user to determine the manage permission
    // We use the uuid instead of the user_uuid here, since that is what is used in CollectionUser
+    // This lists other members for admins, so it must not depend on the membership status
    let membership_type: HashMap<MembershipId, i32> =
-        Membership::find_confirmed_by_org(&org_id, &conn).await.into_iter().map(|m| (m.uuid, m.atype)).collect();
+        Membership::find_by_org(&org_id, &conn).await.into_iter().map(|m| (m.uuid, m.atype)).collect();

    // check if current user has full access to the organization (either directly or via any group)
    let has_full_access_to_org = member.has_full_access()
@@ -639,17 +608,6 @@ async fn put_organization_collection_update(
    headers: ManagerHeaders,
    data: Json<FullCollectionData>,
    conn: DbConn,
-) -> JsonResult {
-    post_organization_collection_update(org_id, col_id, headers, data, conn).await
-}
-
-#[post("/organizations/<org_id>/collections/<col_id>", data = "<data>", rank = 2)]
-async fn post_organization_collection_update(
-    org_id: OrganizationId,
-    col_id: CollectionId,
-    headers: ManagerHeaders,
-    data: Json<FullCollectionData>,
-    conn: DbConn,
 ) -> JsonResult {
    if org_id != headers.org_id {
        err!("Organization not found", "Organization id's do not match");
@@ -745,16 +703,6 @@ async fn delete_organization_collection(
    delete_organization_collection_impl(&org_id, &col_id, &headers, &conn).await
 }

-#[post("/organizations/<org_id>/collections/<col_id>/delete")]
-async fn post_organization_collection_delete(
-    org_id: OrganizationId,
-    col_id: CollectionId,
-    headers: ManagerHeaders,
-    conn: DbConn,
-) -> EmptyResult {
-    delete_organization_collection_impl(&org_id, &col_id, &headers, &conn).await
-}
-
 #[derive(Deserialize, Debug)]
 #[serde(rename_all = "camelCase")]
 struct BulkCollectionIds {
@@ -818,11 +766,9 @@ async fn get_org_collection_detail(

            // Generate a HashMap to get the correct MembershipType per user to determine the manage permission
            // We use the uuid instead of the user_uuid here, since that is what is used in CollectionUser
-            let membership_type: HashMap<MembershipId, i32> = Membership::find_confirmed_by_org(&org_id, &conn)
-                .await
-                .into_iter()
-                .map(|m| (m.uuid, m.atype))
-                .collect();
+            // This lists other members for admins, so it must not depend on the membership status
+            let membership_type: HashMap<MembershipId, i32> =
+                Membership::find_by_org(&org_id, &conn).await.into_iter().map(|m| (m.uuid, m.atype)).collect();

            let users: Vec<Value> =
                CollectionUser::find_by_org_and_coll_swap_user_uuid_with_member_uuid(&org_id, &collection.uuid, &conn)
@@ -960,8 +906,9 @@ async fn get_members(

    let mut users_json = Vec::new();
    for u in Membership::find_by_org(&org_id, &conn).await {
+        // The user can be a manager instead of an admin, but we've checked above that they have full access
        users_json.push(
-            u.to_json_user_details(
+            u.to_json_details_for_admin(
                data.include_collections.unwrap_or(false),
                data.include_groups.unwrap_or(false),
                &conn,
@@ -1075,7 +1022,7 @@ async fn send_invite(
            && data.permissions.get("deleteAnyCollection") == Some(&json!(true))
            && data.permissions.get("createNewCollections") == Some(&json!(true)));

-    let mut user_created: bool = false;
+    let mut user_created: bool;
    for email in &data.emails {
        let mut member_status = MembershipStatus::Invited as i32;
        let user = match User::find_by_mail(email, &conn).await {
@@ -1110,6 +1057,7 @@ async fn send_invite(
                        member_status = MembershipStatus::Accepted as i32;
                    }
                }
+                user_created = false;
                user
            }
        };
@@ -1515,7 +1463,9 @@ async fn get_user(
    // In this case, when groups are requested we also need to include collections.
    // Else these will not be shown in the interface, and could lead to missing collections when saved.
    let include_groups = data.include_groups.unwrap_or(false);
-    Ok(Json(user.to_json_user_details(data.include_collections.unwrap_or(include_groups), include_groups, &conn).await))
+    Ok(Json(
+        user.to_json_details_for_admin(data.include_collections.unwrap_or(include_groups), include_groups, &conn).await,
+    ))
 }

 #[derive(Deserialize)]
@@ -1529,17 +1479,6 @@ struct EditUserData {
 }

 #[put("/organizations/<org_id>/users/<member_id>", data = "<data>", rank = 1)]
-async fn put_member(
-    org_id: OrganizationId,
-    member_id: MembershipId,
-    data: Json<EditUserData>,
-    headers: AdminHeaders,
-    conn: DbConn,
-) -> EmptyResult {
-    edit_member(org_id, member_id, data, headers, conn).await
-}
-
-#[post("/organizations/<org_id>/users/<member_id>", data = "<data>", rank = 1)]
 async fn edit_member(
    org_id: OrganizationId,
    member_id: MembershipId,
@@ -1834,6 +1773,10 @@ async fn post_org_import(
    if org_id != headers.membership.org_uuid {
        err!("Organization not found", "Organization id's do not match");
    }
+    // OrgMemberHeaders also allows invited and accepted members, which are not allowed to import
+    if headers.membership.status != MembershipStatus::Confirmed as i32 {
+        err!("You need to be a Member of the Organization to call this endpoint")
+    }
    let data: ImportData = data.into_inner();

    // Validate the import before continuing
@@ -1915,7 +1858,7 @@ async fn post_org_import(
 #[serde(rename_all = "camelCase")]
 struct BulkCollectionsData {
    organization_id: OrganizationId,
-    cipher_ids: Vec<CipherId>,
+    cipher_ids: HashSet<CipherId>,
    collection_ids: HashSet<CollectionId>,
    remove_collections: bool,
 }
@@ -2194,18 +2137,6 @@ async fn put_policy(
    Ok(Json(policy.to_json()))
 }

-// Deprecated with client v2026.5.0
-#[put("/organizations/<org_id>/policies/<pol_type>/vnext", data = "<data>")]
-async fn put_policy_vnext(
-    org_id: OrganizationId,
-    pol_type: i32,
-    data: Json<PutPolicy>,
-    headers: AdminHeaders,
-    conn: DbConn,
-) -> JsonResult {
-    put_policy(org_id, pol_type, data, headers, conn).await
-}
-
 #[get("/plans")]
 fn get_plans() -> Json<Value> {
    // Respond with a minimal json just enough to allow the creation of an new organization.
@@ -2234,12 +2165,6 @@ fn get_plans() -> Json<Value> {
    }))
 }

-#[get("/organizations/<_org_id>/billing/metadata")]
-fn get_billing_metadata(_org_id: OrganizationId, _headers: OrgMemberHeaders) -> Json<Value> {
-    // Prevent a 404 error, which also causes Javascript errors.
-    Json(empty_data_json())
-}
-
 #[get("/organizations/<_org_id>/billing/vnext/warnings")]
 fn get_billing_warnings(_org_id: OrganizationId, _headers: OrgMemberHeaders) -> Json<Value> {
    Json(json!({
@@ -2259,14 +2184,6 @@ fn get_self_host_billing_metadata(_org_id: OrganizationId, _headers: OrgMemberHe
    }))
 }

-fn empty_data_json() -> Value {
-    json!({
-        "object": "list",
-        "data": [],
-        "continuationToken": null
-    })
-}
-
 #[derive(Deserialize, Debug)]
 #[serde(rename_all = "camelCase")]
 struct BulkRevokeMembershipIds {
@@ -2585,17 +2502,6 @@ impl CollectionData {
    }
 }

-#[post("/organizations/<org_id>/groups/<group_id>", data = "<data>")]
-async fn post_group(
-    org_id: OrganizationId,
-    group_id: GroupId,
-    data: Json<GroupRequest>,
-    headers: AdminHeaders,
-    conn: DbConn,
-) -> JsonResult {
-    put_group(org_id, group_id, data, headers, conn).await
-}
-
 #[post("/organizations/<org_id>/groups", data = "<data>")]
 async fn post_groups(
    org_id: OrganizationId,
@@ -2705,7 +2611,6 @@ async fn add_update_group(
        "id": group.uuid,
        "organizationId": group.organizations_uuid,
        "name": group.name,
-        "accessAll": group.access_all,
        "externalId": group.external_id,
        "object": "group"
    })))
@@ -2732,16 +2637,6 @@ async fn get_group_details(
    Ok(Json(group.to_json_details(&conn).await))
 }

-#[post("/organizations/<org_id>/groups/<group_id>/delete")]
-async fn post_delete_group(
-    org_id: OrganizationId,
-    group_id: GroupId,
-    headers: AdminHeaders,
-    conn: DbConn,
-) -> EmptyResult {
-    delete_group_impl(&org_id, &group_id, &headers, &conn).await
-}
-
 #[delete("/organizations/<org_id>/groups/<group_id>")]
 async fn delete_group(org_id: OrganizationId, group_id: GroupId, headers: AdminHeaders, conn: DbConn) -> EmptyResult {
    delete_group_impl(&org_id, &group_id, &headers, &conn).await
@@ -2843,90 +2738,6 @@ async fn get_group_members(
    Ok(Json(json!(group_members)))
 }

-#[put("/organizations/<org_id>/groups/<group_id>/users", data = "<data>")]
-async fn put_group_members(
-    org_id: OrganizationId,
-    group_id: GroupId,
-    headers: AdminHeaders,
-    data: Json<Vec<MembershipId>>,
-    conn: DbConn,
-) -> EmptyResult {
-    if org_id != headers.org_id {
-        err!("Organization not found", "Organization id's do not match");
-    }
-    if !CONFIG.org_groups_enabled() {
-        err!("Group support is disabled");
-    }
-
-    if Group::find_by_uuid_and_org(&group_id, &org_id, &conn).await.is_none() {
-        err!("Group could not be found!", "Group uuid is invalid or does not belong to the organization")
-    }
-
-    let assigned_members = data.into_inner();
-
-    let org_memberships = Membership::find_by_org(&org_id, &conn).await;
-    let org_membership_ids: HashSet<&MembershipId> = org_memberships.iter().map(|m| &m.uuid).collect();
-    if let Some(e) = assigned_members.iter().find(|m| !org_membership_ids.contains(m)) {
-        err!("Invalid member", format!("Member {} does not belong to organization {}!", e, org_id))
-    }
-
-    GroupUser::delete_all_by_group(&group_id, &org_id, &conn).await?;
-    for assigned_member in assigned_members {
-        let mut user_entry = GroupUser::new(group_id.clone(), assigned_member.clone());
-        user_entry.save(&conn).await?;
-
-        log_event(
-            EventType::OrganizationUserUpdatedGroups,
-            &assigned_member,
-            &org_id,
-            &headers.user.uuid,
-            headers.device.atype,
-            &headers.ip.ip,
-            &conn,
-        )
-        .await;
-    }
-
-    Ok(())
-}
-
-#[post("/organizations/<org_id>/groups/<group_id>/delete-user/<member_id>")]
-async fn post_delete_group_member(
-    org_id: OrganizationId,
-    group_id: GroupId,
-    member_id: MembershipId,
-    headers: AdminHeaders,
-    conn: DbConn,
-) -> EmptyResult {
-    if org_id != headers.org_id {
-        err!("Organization not found", "Organization id's do not match");
-    }
-    if !CONFIG.org_groups_enabled() {
-        err!("Group support is disabled");
-    }
-
-    if Membership::find_by_uuid_and_org(&member_id, &org_id, &conn).await.is_none() {
-        err!("User could not be found or does not belong to the organization.");
-    }
-
-    if Group::find_by_uuid_and_org(&group_id, &org_id, &conn).await.is_none() {
-        err!("Group could not be found or does not belong to the organization.");
-    }
-
-    log_event(
-        EventType::OrganizationUserUpdatedGroups,
-        &member_id,
-        &org_id,
-        &headers.user.uuid,
-        headers.device.atype,
-        &headers.ip.ip,
-        &conn,
-    )
-    .await;
-
-    GroupUser::delete_by_group_and_member(&group_id, &member_id, &conn).await
-}
-
 #[derive(Deserialize)]
 #[serde(rename_all = "camelCase")]
 struct OrganizationUserResetPasswordEnrollmentRequest {
@@ -2986,19 +2797,6 @@ async fn put_recover_account(
    recover_account(org_id, member_id, headers, data.into_inner(), conn, nt).await
 }

-// Deprecated since `v2026.4.2`
-#[put("/organizations/<org_id>/users/<member_id>/reset-password", data = "<data>")]
-async fn put_reset_password(
-    org_id: OrganizationId,
-    member_id: MembershipId,
-    headers: AdminHeaders,
-    data: Json<OrganizationUserRecoverAccountRequest>,
-    conn: DbConn,
-    nt: Notify<'_>,
-) -> EmptyResult {
-    recover_account(org_id, member_id, headers, data.into_inner(), conn, nt).await
-}
-
 async fn recover_account(
    org_id: OrganizationId,
    member_id: MembershipId,
@@ -3031,11 +2829,12 @@ async fn recover_account(
        err!("Organization user must be confirmed for password reset functionality");
    }

-    let fallback_2fa_email = if req.reset_two_factor && CONFIG.email_2fa_auto_fallback() {
-        TwoFactor::find_by_user_and_type(&user.uuid, TwoFactorType::Email as i32, &conn).await.is_none()
-    } else {
-        false
-    };
+    let fallback_2fa_email =
+        if req.reset_two_factor && CONFIG.mail_enabled() && CONFIG.email_2fa_auto_fallback() && user.verified() {
+            TwoFactor::find_by_user_and_type(&user.uuid, TwoFactorType::Email as i32, &conn).await.is_none()
+        } else {
+            false
+        };

    // Sending email first ensure working email configuration and the resulting user notification.
    // Also this might add some protection against security flaws and misuse
@@ -3064,6 +2863,7 @@ async fn recover_account(

    if req.reset_two_factor {
        TwoFactor::delete_all_by_user(&user.uuid, &conn).await?;
+        Device::clear_twofactor_remember_by_user(&user.uuid, &conn).await?;
        if !fallback_2fa_email || two_factor::email::find_and_activate_email_2fa(&user.uuid, &conn).await.is_err() {
            two_factor::enforce_2fa_policy(&user, &headers.user.uuid, headers.device.atype, &headers.ip.ip, &conn)
                .await?;
@@ -3232,7 +3032,7 @@ async fn api_key(
    org_id: &OrganizationId,
    data: Json<PasswordOrOtpData>,
    rotate: bool,
-    headers: AdminHeaders,
+    headers: OwnerHeaders,
    conn: DbConn,
 ) -> JsonResult {
    if org_id != &headers.org_id {
@@ -3241,7 +3041,7 @@ async fn api_key(
    let data: PasswordOrOtpData = data.into_inner();
    let user = headers.user;

-    // Validate the admin users password/otp
+    // Validate the owner users password/otp
    data.validate(&user, true, &conn).await?;

    let org_api_key = if let Some(mut org_api_key) = OrganizationApiKey::find_by_org_uuid(org_id, &conn).await {
@@ -3269,7 +3069,7 @@ async fn api_key(
 async fn post_api_key(
    org_id: OrganizationId,
    data: Json<PasswordOrOtpData>,
-    headers: AdminHeaders,
+    headers: OwnerHeaders,
    conn: DbConn,
 ) -> JsonResult {
    api_key(&org_id, data, false, headers, conn).await
@@ -3279,7 +3079,7 @@ async fn post_api_key(
 async fn rotate_api_key(
    org_id: OrganizationId,
    data: Json<PasswordOrOtpData>,
-    headers: AdminHeaders,
+    headers: OwnerHeaders,
    conn: DbConn,
 ) -> JsonResult {
    api_key(&org_id, data, true, headers, conn).await
@@ -12,7 +12,7 @@ use serde_json::Value;
 use crate::{
    CONFIG,
    api::{ApiResult, EmptyResult, JsonResult, Notify, UpdateType},
-    auth::{ClientIp, Headers, Host, SendHeaders},
+    auth::{Headers, Host, SendHeaders},
    config::PathType,
    db::{
        DbConn, DbPool,
@@ -46,11 +46,8 @@ pub fn routes() -> Vec<rocket::Route> {
        get_sends,
        get_send,
        post_send,
-        post_send_file,
        post_access,
-        post_access_legacy,
        post_access_file,
-        post_access_file_legacy,
        put_send,
        delete_send,
        put_remove_password,
@@ -73,7 +70,7 @@ pub async fn purge_sends(pool: DbPool) {
 #[serde(rename_all = "camelCase")]
 pub struct SendData {
    r#type: i32,
-    key: String,
+    pub key: String,
    password: Option<String>,
    max_access_count: Option<NumberOrString>,
    expiration_date: Option<DateTime<Utc>>,
@@ -201,7 +198,7 @@ async fn post_send(data: Json<SendData>, headers: Headers, conn: DbConn, nt: Not
    enforce_disable_hide_email_policy(&data, &headers, &conn).await?;

    if data.r#type == SendType::File as i32 {
-        err!("File sends should use /api/sends/file")
+        err!("File sends should use /api/sends/file/v2")
    }

    let mut send = create_send(data, headers.user.uuid)?;
@@ -218,93 +215,11 @@ async fn post_send(data: Json<SendData>, headers: Headers, conn: DbConn, nt: Not
    Ok(Json(send.to_json()))
 }

-#[derive(FromForm)]
-struct UploadData<'f> {
-    model: Json<SendData>,
-    data: TempFile<'f>,
-}
-
 #[derive(FromForm)]
 struct UploadDataV2<'f> {
    data: TempFile<'f>,
 }

-// @deprecated Mar 25 2021: This method has been deprecated in favor of direct uploads (v2).
-// This method still exists to support older clients, probably need to remove it sometime.
-// Upstream: https://github.com/bitwarden/server/blob/d0c793c95181dfb1b447eb450f85ba0bfd7ef643/src/Api/Controllers/SendsController.cs#L164-L167
-// 2025: This endpoint doesn't seem to exists anymore in the latest version
-// See: https://github.com/bitwarden/server/blob/9ebe16587175b1c0e9208f84397bb75d0d595510/src/Api/Tools/Controllers/SendsController.cs
-#[post("/sends/file", format = "multipart/form-data", data = "<data>")]
-async fn post_send_file(data: Form<UploadData<'_>>, headers: Headers, conn: DbConn, nt: Notify<'_>) -> JsonResult {
-    enforce_disable_send_policy(&headers, &conn).await?;
-
-    let UploadData {
-        model,
-        data,
-    } = data.into_inner();
-    let model = model.into_inner();
-
-    let Some(size) = data.len().to_i64() else {
-        err!("Invalid send size");
-    };
-    if size < 0 {
-        err!("Send size can't be negative")
-    }
-
-    enforce_disable_hide_email_policy(&model, &headers, &conn).await?;
-
-    let size_limit = match CONFIG.user_send_limit() {
-        Some(0) => err!("File uploads are disabled"),
-        Some(limit_kb) => {
-            let Some(already_used) = Send::size_by_user(&headers.user.uuid, &conn).await else {
-                err!("Existing sends overflow")
-            };
-            let Some(left) = limit_kb.checked_mul(1024).and_then(|l| l.checked_sub(already_used)) else {
-                err!("Send size overflow");
-            };
-            if left <= 0 {
-                err!("Send storage limit reached! Delete some sends to free up space")
-            }
-            i64::clamp(left, 0, SIZE_525_MB)
-        }
-        None => SIZE_525_MB,
-    };
-
-    if size > size_limit {
-        err!("Send storage limit exceeded with this file");
-    }
-
-    let mut send = create_send(model, headers.user.uuid)?;
-    if send.atype != SendType::File as i32 {
-        err!("Send content is not a file");
-    }
-
-    let file_id = crate::crypto::generate_send_file_id();
-
-    save_temp_file(&PathType::Sends, &format!("{}/{file_id}", send.uuid), data, true).await?;
-
-    let mut data_value: Value = serde_json::from_str(&send.data)?;
-    if let Some(o) = data_value.as_object_mut() {
-        o.insert(String::from("id"), Value::String(file_id));
-        o.insert(String::from("size"), Value::Number(size.into()));
-        o.insert(String::from("sizeName"), Value::String(crate::util::get_display_size(size)));
-    }
-    send.data = serde_json::to_string(&data_value)?;
-
-    // Save the changes in the database
-    send.save(&conn).await?;
-    nt.send_send_update(
-        UpdateType::SyncSendCreate,
-        &send,
-        &send.update_users_revision(&conn).await,
-        &headers.device,
-        &conn,
-    )
-    .await;
-
-    Ok(Json(send.to_json()))
-}
-
 // Upstream: https://github.com/bitwarden/server/blob/9ebe16587175b1c0e9208f84397bb75d0d595510/src/Api/Tools/Controllers/SendsController.cs#L165
 #[post("/sends/file/v2", data = "<data>")]
 async fn post_send_file_v2(data: Json<SendData>, headers: Headers, conn: DbConn) -> JsonResult {
@@ -450,63 +365,16 @@ async fn post_send_file_v2_data(

 #[post("/sends/access")]
 async fn post_access(headers: SendHeaders, conn: DbConn, nt: Notify<'_>) -> JsonResult {
-    let Some(send) = Send::find_by_uuid(&headers.send_id, &conn).await else {
+    let Some(mut send) = Send::find_by_uuid(&headers.send_id, &conn).await else {
        err_code!(SEND_INACCESSIBLE_MSG, 404)
    };
    if !send.is_accessible() {
        err_code!(SEND_INACCESSIBLE_MSG, 404)
    }
-    process_access(send, conn, nt).await
-}
-
-#[derive(Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct SendAccessData {
-    pub password: Option<String>,
-}
-
-// Legacy since web-2026.6.0
-#[post("/sends/access/<access_id>", data = "<data>")]
-async fn post_access_legacy(
-    access_id: &str,
-    data: Json<SendAccessData>,
-    conn: DbConn,
-    ip: ClientIp,
-    nt: Notify<'_>,
-) -> JsonResult {
-    crate::ratelimit::check_limit_unauthenticated(&ip.ip)?;
-
-    let Some(mut send) = Send::find_by_access_id(access_id, &conn).await else {
-        err_code!(SEND_INACCESSIBLE_MSG, 404)
-    };
-
-    if let Some(max_access_count) = send.max_access_count
-        && send.access_count >= max_access_count
-    {
-        err_code!(SEND_INACCESSIBLE_MSG, 404);
-    }
-
-    if !send.is_accessible() {
-        err_code!(SEND_INACCESSIBLE_MSG, 404)
-    }
-
-    if send.password_hash.is_some() {
-        match data.into_inner().password {
-            Some(ref p) if send.check_password(p) => { /* Nothing to do here */ }
-            Some(_) => err!("Invalid password", format!("IP: {}.", ip.ip)),
-            None => err_code!("Password not provided", format!("IP: {}.", ip.ip), 401),
-        }
-    }
-
    // Files are incremented during the download
-    if send.atype == SendType::Text as i32 {
-        if !send.register_access(&conn).await? {
-            err_code!(SEND_INACCESSIBLE_MSG, 404)
-        }
-    } else {
-        send.save(&conn).await?;
+    if send.atype == SendType::Text as i32 && !send.register_access(&conn).await? {
+        err_code!(SEND_INACCESSIBLE_MSG, 404)
    }
-
    process_access(send, conn, nt).await
 }

@@ -531,55 +399,27 @@ async fn post_access_file(
    conn: DbConn,
    nt: Notify<'_>,
 ) -> JsonResult {
-    let Some(send) = Send::find_by_uuid(&headers.send_id, &conn).await else {
+    let Some(mut send) = Send::find_by_uuid(&headers.send_id, &conn).await else {
        err_code!(SEND_INACCESSIBLE_MSG, 404)
    };
    if !send.is_accessible() {
        err_code!(SEND_INACCESSIBLE_MSG, 404)
    }
+    check_send_file_id(&send, &file_id)?;
+    if !send.register_access(&conn).await? {
+        err_code!(SEND_INACCESSIBLE_MSG, 404)
+    }
    process_access_file(send, file_id, host, conn, nt).await
 }

-// Legacy since web-2026.6.0
-#[post("/sends/<send_id>/access/file/<file_id>", data = "<data>")]
-async fn post_access_file_legacy(
-    send_id: SendId,
-    file_id: SendFileId,
-    data: Json<SendAccessData>,
-    host: Host,
-    conn: DbConn,
-    ip: ClientIp,
-    nt: Notify<'_>,
-) -> JsonResult {
-    crate::ratelimit::check_limit_unauthenticated(&ip.ip)?;
-
-    let Some(mut send) = Send::find_by_uuid(&send_id, &conn).await else {
-        err_code!(SEND_INACCESSIBLE_MSG, 404)
-    };
-
-    if let Some(max_access_count) = send.max_access_count
-        && send.access_count >= max_access_count
-    {
-        err_code!(SEND_INACCESSIBLE_MSG, 404)
+fn check_send_file_id(send: &Send, file_id: &SendFileId) -> EmptyResult {
+    if send.atype != SendType::File as i32 {
+        err!("Send is not a file type send.");
    }
-
-    if !send.is_accessible() {
-        err_code!(SEND_INACCESSIBLE_MSG, 404)
+    match serde_json::from_str::<SendFileData>(&send.data) {
+        Ok(data) if &data.id == file_id => Ok(()),
+        _ => err_code!(SEND_INACCESSIBLE_MSG, 404),
    }
-
-    if send.password_hash.is_some() {
-        match data.into_inner().password {
-            Some(ref p) if send.check_password(p) => { /* Nothing to do here */ }
-            Some(_) => err!("Invalid password."),
-            None => err_code!("Password not provided", 401),
-        }
-    }
-
-    if !send.register_access(&conn).await? {
-        err_code!(SEND_INACCESSIBLE_MSG, 404)
-    }
-
-    process_access_file(send, file_id, host, conn, nt).await
 }

 async fn process_access_file(send: Send, file_id: SendFileId, host: Host, conn: DbConn, nt: Notify<'_>) -> JsonResult {
@@ -642,7 +482,7 @@ async fn put_send(send_id: SendId, data: Json<SendData>, headers: Headers, conn:
    Ok(Json(send.to_json()))
 }

-pub async fn update_send_from_data(
+async fn update_send_from_data(
    send: &mut Send,
    data: SendData,
    headers: &Headers,
@@ -7,7 +7,7 @@ use crate::{
    crypto,
    db::{
        DbConn,
-        models::{EventType, TwoFactor, TwoFactorType, UserId},
+        models::{Device, EventType, TwoFactor, TwoFactorType, UserId},
    },
    util::NumberOrString,
 };
@@ -200,6 +200,7 @@ async fn disable_authenticator(data: Json<DisableAuthenticatorData>, headers: He
    if let Some(twofactor) = TwoFactor::find_by_user_and_type(&user.uuid, type_, &conn).await {
        if twofactor.data == data.key {
            twofactor.delete(&conn).await?;
+            Device::clear_twofactor_remember_by_user(&user.uuid, &conn).await?;
            log_user_event(EventType::UserDisabled2fa as i32, &user.uuid, headers.device.atype, &headers.ip.ip, &conn)
                .await;
        } else {
@@ -1,5 +1,4 @@
 use chrono::Utc;
-use data_encoding::BASE64;
 use rocket::{Route, serde::json::Json};

 use crate::{
@@ -222,13 +221,6 @@ async fn duo_api_request(method: &str, path: &str, params: &str, data: &DuoData)
    Ok(())
 }

-const DUO_EXPIRE: i64 = 300;
-const APP_EXPIRE: i64 = 3600;
-
-const AUTH_PREFIX: &str = "AUTH";
-const DUO_PREFIX: &str = "TX";
-const APP_PREFIX: &str = "APP";
-
 async fn get_user_duo_data(user_id: &UserId, conn: &DbConn) -> DuoStatus {
    let type_ = TwoFactorType::Duo as i32;

@@ -251,118 +243,13 @@ async fn get_user_duo_data(user_id: &UserId, conn: &DbConn) -> DuoStatus {
    DuoStatus::Disabled(false)
 }

-// let (ik, sk, ak, host) = get_duo_keys();
-pub(crate) async fn get_duo_keys_email(email: &str, conn: &DbConn) -> ApiResult<(String, String, String, String)> {
+// let (ik, sk, host) = get_duo_keys_email();
+pub(crate) async fn get_duo_keys_email(email: &str, conn: &DbConn) -> ApiResult<(String, String, String)> {
    let data = match User::find_by_mail(email, conn).await {
        Some(u) => get_user_duo_data(&u.uuid, conn).await.data(),
        _ => DuoData::global(),
    }
    .map_res("Can't fetch Duo Keys")?;

-    Ok((data.ik, data.sk, CONFIG.get_duo_akey().await, data.host))
-}
-
-pub async fn generate_duo_signature(email: &str, conn: &DbConn) -> ApiResult<(String, String)> {
-    let now = Utc::now().timestamp();
-
-    let (ik, sk, ak, host) = get_duo_keys_email(email, conn).await?;
-
-    let duo_sign = sign_duo_values(&sk, email, &ik, DUO_PREFIX, now + DUO_EXPIRE);
-    let app_sign = sign_duo_values(&ak, email, &ik, APP_PREFIX, now + APP_EXPIRE);
-
-    Ok((format!("{duo_sign}:{app_sign}"), host))
-}
-
-fn sign_duo_values(key: &str, email: &str, ikey: &str, prefix: &str, expire: i64) -> String {
-    let val = format!("{email}|{ikey}|{expire}");
-    let cookie = format!("{prefix}|{}", BASE64.encode(val.as_bytes()));
-
-    format!("{cookie}|{}", crypto::hmac_sign(key, &cookie))
-}
-
-pub async fn validate_duo_login(email: &str, response: &str, conn: &DbConn) -> EmptyResult {
-    let split: Vec<&str> = response.split(':').collect();
-    if split.len() != 2 {
-        err!(
-            "Invalid response length",
-            ErrorEvent {
-                event: EventType::UserFailedLogIn2fa
-            }
-        );
-    }
-
-    let auth_sig = split[0];
-    let app_sig = split[1];
-
-    let now = Utc::now().timestamp();
-
-    let (ik, sk, ak, _host) = get_duo_keys_email(email, conn).await?;
-
-    let auth_user = parse_duo_values(&sk, auth_sig, &ik, AUTH_PREFIX, now)?;
-    let app_user = parse_duo_values(&ak, app_sig, &ik, APP_PREFIX, now)?;
-
-    if !crypto::ct_eq(&auth_user, app_user) || !crypto::ct_eq(&auth_user, email) {
-        err!(
-            "Error validating duo authentication",
-            ErrorEvent {
-                event: EventType::UserFailedLogIn2fa
-            }
-        )
-    }
-
-    Ok(())
-}
-
-fn parse_duo_values(key: &str, val: &str, ikey: &str, prefix: &str, time: i64) -> ApiResult<String> {
-    let split: Vec<&str> = val.split('|').collect();
-    if split.len() != 3 {
-        err!("Invalid value length")
-    }
-
-    let u_prefix = split[0];
-    let u_b64 = split[1];
-    let u_sig = split[2];
-
-    let sig = crypto::hmac_sign(key, &format!("{u_prefix}|{u_b64}"));
-
-    if !crypto::ct_eq(crypto::hmac_sign(key, &sig), crypto::hmac_sign(key, u_sig)) {
-        err!("Duo signatures don't match")
-    }
-
-    if u_prefix != prefix {
-        err!("Prefixes don't match")
-    }
-
-    let Ok(cookie_vec) = BASE64.decode(u_b64.as_bytes()) else {
-        err!("Invalid Duo cookie encoding")
-    };
-
-    let Ok(cookie) = String::from_utf8(cookie_vec) else {
-        err!("Invalid Duo cookie encoding")
-    };
-
-    let cookie_split: Vec<&str> = cookie.split('|').collect();
-    if cookie_split.len() != 3 {
-        err!("Invalid cookie length")
-    }
-
-    let username = cookie_split[0];
-    let u_ikey = cookie_split[1];
-    let expire = cookie_split[2];
-
-    if !crypto::ct_eq(ikey, u_ikey) {
-        err!("Invalid ikey")
-    }
-
-    let expire: i64 = if let Ok(e) = expire.parse() {
-        e
-    } else {
-        err!("Invalid expire time")
-    };
-
-    if time >= expire {
-        err!("Expired authorization")
-    }
-
-    Ok(username.into())
+    Ok((data.ik, data.sk, data.host))
 }
@@ -383,7 +383,7 @@ pub async fn get_duo_auth_url(
    device_identifier: &DeviceId,
    conn: &DbConn,
 ) -> Result<String, Error> {
-    let (ik, sk, _, host) = get_duo_keys_email(email, conn).await?;
+    let (ik, sk, host) = get_duo_keys_email(email, conn).await?;

    let callback_url = match make_callback_url(client_id) {
        Ok(url) => url,
@@ -435,7 +435,7 @@ pub async fn validate_duo_login(
    let code = split[0];
    let state = split[1];

-    let (ik, sk, _, host) = get_duo_keys_email(email, conn).await?;
+    let (ik, sk, host) = get_duo_keys_email(email, conn).await?;

    // Get the context by the state reported by the client. If we don't have one,
    // it means the context is either missing or expired.
@@ -65,7 +65,7 @@ async fn send_email_login(data: Json<SendEmailLoginData>, client_headers: Client
        let Some(user) = User::find_by_mail(email, &conn).await else {
            err!(
                "Username or password is incorrect. Try again",
-                format!("IP: {}. Username: {email}.", client_headers.ip.ip)
+                format!("IP: {}. Username: {}.", client_headers.ip.ip, email.escape_debug())
            )
        };

@@ -74,7 +74,7 @@ async fn send_email_login(data: Json<SendEmailLoginData>, client_headers: Client
            if !user.check_valid_password(master_password_hash) {
                err!(
                    "Username or password is incorrect. Try again",
-                    format!("IP: {}. Username: {email}.", client_headers.ip.ip)
+                    format!("IP: {}. Username: {}.", client_headers.ip.ip, email.escape_debug())
                )
            }
        } else if let Some(auth_request_id) = auth_request_id {
@@ -188,7 +188,7 @@ async fn send_email(data: Json<SendEmailData>, headers: Headers, conn: DbConn) -
    }

    let generated_token = crypto::generate_email_token(CONFIG.email_token_size());
-    let twofactor_data = EmailTokenData::new(data.email, generated_token);
+    let twofactor_data = EmailTokenData::new(data.email, Some(generated_token));

    // Uses EmailVerificationChallenge as type to show that it's not verified yet.
    let twofactor = TwoFactor::new(user.uuid, TwoFactorType::EmailVerificationChallenge, twofactor_data.to_json());
@@ -322,10 +322,10 @@ pub struct EmailTokenData {
 }

 impl EmailTokenData {
-    pub fn new(email: String, token: String) -> EmailTokenData {
+    pub fn new(email: String, token: Option<String>) -> EmailTokenData {
        EmailTokenData {
            email,
-            last_token: Some(token),
+            last_token: token,
            token_sent: Utc::now().timestamp(),
            attempts: 0,
        }
@@ -363,7 +363,8 @@ pub async fn activate_email_2fa(user: &User, conn: &DbConn) -> EmptyResult {
    if user.verified_at.is_none() {
        err!("Auto-enabling of email 2FA failed because the users email address has not been verified!");
    }
-    let twofactor_data = EmailTokenData::new(user.email.clone(), String::new());
+    // The token is set when the first code is sent
+    let twofactor_data = EmailTokenData::new(user.email.clone(), None);
    let twofactor = TwoFactor::new(user.uuid.clone(), TwoFactorType::Email, twofactor_data.to_json());
    twofactor.save(conn).await
 }
@@ -69,13 +69,7 @@ pub fn is_twofactor_provider_usable(provider_type: &TwoFactorType, provider_data
 }

 pub fn routes() -> Vec<Route> {
-    let mut routes = routes![
-        get_twofactor,
-        get_recover,
-        disable_twofactor,
-        disable_twofactor_put,
-        get_device_verification_settings,
-    ];
+    let mut routes = routes![get_twofactor, get_recover, disable_twofactor, get_device_verification_settings];

    routes.append(&mut authenticator::routes());
    routes.append(&mut duo::routes());
@@ -134,7 +128,7 @@ struct DisableTwoFactorData {
    r#type: NumberOrString,
 }

-#[post("/two-factor/disable", data = "<data>")]
+#[put("/two-factor/disable", data = "<data>")]
 async fn disable_twofactor(data: Json<DisableTwoFactorData>, headers: Headers, conn: DbConn) -> JsonResult {
    let data: DisableTwoFactorData = data.into_inner();
    let user = headers.user;
@@ -167,11 +161,6 @@ async fn disable_twofactor(data: Json<DisableTwoFactorData>, headers: Headers, c
    })))
 }

-#[put("/two-factor/disable", data = "<data>")]
-async fn disable_twofactor_put(data: Json<DisableTwoFactorData>, headers: Headers, conn: DbConn) -> JsonResult {
-    disable_twofactor(data, headers, conn).await
-}
-
 pub async fn enforce_2fa_policy(
    user: &User,
    act_user_id: &UserId,
@@ -24,7 +24,7 @@ use crate::{
    crypto::ct_eq,
    db::{
        DbConn,
-        models::{EventType, TwoFactor, TwoFactorType, UserId},
+        models::{Device, EventType, TwoFactor, TwoFactorType, UserId},
    },
    error::Error,
    util::NumberOrString,
@@ -338,6 +338,7 @@ async fn delete_webauthn(data: Json<DeleteU2FData>, headers: Headers, conn: DbCo
    tf.data = serde_json::to_string(&data)?;
    tf.save(&conn).await?;
    drop(tf);
+    Device::clear_twofactor_remember_by_user(&headers.user.uuid, &conn).await?;

    // If entry is migrated from u2f, delete the u2f entry as well
    if let Some(mut u2f) = TwoFactor::find_by_user_and_type(&headers.user.uuid, TwoFactorType::U2f as i32, &conn).await
@@ -17,15 +17,14 @@ use crate::{
            accounts::{PreloginData, RegisterData, kdf_upgrade, prelogin, register},
            log_user_event,
            two_factor::{
-                authenticator, duo, duo_oidc, email, enforce_2fa_policy, is_twofactor_provider_usable, webauthn,
-                yubikey,
+                authenticator, duo_oidc, email, enforce_2fa_policy, is_twofactor_provider_usable, webauthn, yubikey,
            },
        },
        master_password_policy,
        push::register_push_device,
    },
    auth,
-    auth::{AuthMethod, ClientHeaders, ClientIp, ClientVersion, Secure, generate_organization_api_key_login_claims},
+    auth::{AuthMethod, ClientHeaders, ClientIp, Secure, generate_organization_api_key_login_claims},
    crypto,
    db::{
        DbConn,
@@ -46,7 +45,6 @@ pub fn routes() -> Vec<Route> {
        login,
        post_prelogin,
        prelogin_password,
-        identity_register,
        register_verification_email,
        register_finish,
        prevalidate,
@@ -57,12 +55,7 @@ pub fn routes() -> Vec<Route> {
 }

 #[post("/connect/token", data = "<data>")]
-async fn login(
-    data: Form<ConnectData>,
-    client_header: ClientHeaders,
-    client_version: Option<ClientVersion>,
-    conn: DbConn,
-) -> JsonResult {
+async fn login(data: Form<ConnectData>, client_header: ClientHeaders, conn: DbConn) -> JsonResult {
    let data: ConnectData = data.into_inner();

    let mut user_id: Option<UserId> = None;
@@ -83,7 +76,7 @@ async fn login(
            check_is_some(data.device_name.as_ref(), "device_name cannot be blank")?;
            check_is_some(data.device_type.as_ref(), "device_type cannot be blank")?;

-            password_login(data, &mut user_id, &conn, &client_header.ip, client_version.as_ref()).await
+            password_login(data, &mut user_id, &conn, &client_header.ip).await
        }
        "client_credentials" => {
            check_is_some(data.client_id.as_ref(), "client_id cannot be blank")?;
@@ -105,7 +98,7 @@ async fn login(
            check_is_some(data.device_name.as_ref(), "device_name cannot be blank")?;
            check_is_some(data.device_type.as_ref(), "device_type cannot be blank")?;

-            sso_login(data, &mut user_id, &conn, &client_header.ip, client_version.as_ref()).await
+            sso_login(data, &mut user_id, &conn, &client_header.ip).await
        }
        "authorization_code" => err!("SSO sign-in is not available"),
        "send_access" => {
@@ -190,13 +183,7 @@ async fn refresh_login(data: ConnectData, conn: &DbConn, ip: &ClientIp) -> JsonR
 }

 // After exchanging the code we need to check first if 2FA is needed before continuing
-async fn sso_login(
-    data: ConnectData,
-    user_id: &mut Option<UserId>,
-    conn: &DbConn,
-    ip: &ClientIp,
-    client_version: Option<&ClientVersion>,
-) -> JsonResult {
+async fn sso_login(data: ConnectData, user_id: &mut Option<UserId>, conn: &DbConn, ip: &ClientIp) -> JsonResult {
    AuthMethod::Sso.check_scope(data.scope.as_ref())?;

    // Ratelimit the login
@@ -353,7 +340,7 @@ async fn sso_login(
        Some((mut user, sso_user)) => {
            let mut device = get_device(&data, conn, &user).await?;

-            let twofactor_token = twofactor_auth(&mut user, &data, &mut device, ip, client_version, conn).await?;
+            let twofactor_token = twofactor_auth(&mut user, &data, &mut device, ip, conn).await?;

            if user.private_key.is_none() {
                // User was invited a stub was created
@@ -385,13 +372,7 @@ async fn sso_login(
    authenticated_response(&user, &mut device, auth_tokens, twofactor_token, conn, ip).await
 }

-async fn password_login(
-    data: ConnectData,
-    user_id: &mut Option<UserId>,
-    conn: &DbConn,
-    ip: &ClientIp,
-    client_version: Option<&ClientVersion>,
-) -> JsonResult {
+async fn password_login(data: ConnectData, user_id: &mut Option<UserId>, conn: &DbConn, ip: &ClientIp) -> JsonResult {
    // Validate scope
    AuthMethod::Password.check_scope(data.scope.as_ref())?;

@@ -400,24 +381,14 @@ async fn password_login(

    // Get the user
    let username = data.username.as_ref().unwrap().trim();
+    let log_username = username.escape_debug();
    let Some(mut user) = User::find_by_mail(username, conn).await else {
-        err!("Username or password is incorrect. Try again", format!("IP: {}. Username: {username}.", ip.ip))
+        err!("Username or password is incorrect. Try again", format!("IP: {}. Username: {log_username}.", ip.ip))
    };

    // Set the user_id here to be passed back used for event logging.
    *user_id = Some(user.uuid.clone());

-    // Check if the user is disabled
-    if !user.enabled {
-        err!(
-            "This user has been disabled",
-            format!("IP: {}. Username: {username}.", ip.ip),
-            ErrorEvent {
-                event: EventType::UserFailedLogIn
-            }
-        )
-    }
-
    let password = data.password.as_ref().unwrap();

    // If we get an auth request, we don't check the user's password, but the access code of the auth request
@@ -425,7 +396,7 @@ async fn password_login(
        let Some(auth_request) = AuthRequest::find_by_uuid_and_user(auth_request_id, &user.uuid, conn).await else {
            err!(
                "Auth request not found. Try again.",
-                format!("IP: {}. Username: {username}.", ip.ip),
+                format!("IP: {}. Username: {log_username}.", ip.ip),
                ErrorEvent {
                    event: EventType::UserFailedLogIn,
                }
@@ -443,7 +414,7 @@ async fn password_login(
        {
            err!(
                "Username or access code is incorrect. Try again",
-                format!("IP: {}. Username: {username}.", ip.ip),
+                format!("IP: {}. Username: {log_username}.", ip.ip),
                ErrorEvent {
                    event: EventType::UserFailedLogIn,
                }
@@ -452,13 +423,24 @@ async fn password_login(
    } else if !user.check_valid_password(password) {
        err!(
            "Username or password is incorrect. Try again",
-            format!("IP: {}. Username: {username}.", ip.ip),
+            format!("IP: {}. Username: {log_username}.", ip.ip),
            ErrorEvent {
                event: EventType::UserFailedLogIn,
            }
        )
    }

+    // Check if the user is disabled
+    if !user.enabled {
+        err!(
+            "This user has been disabled",
+            format!("IP: {}. Username: {log_username}.", ip.ip),
+            ErrorEvent {
+                event: EventType::UserFailedLogIn
+            }
+        )
+    }
+
    // Change the KDF Iterations (only when not logging in with an auth request)
    if data.auth_request.is_none() {
        kdf_upgrade(&mut user, password, conn).await?;
@@ -491,7 +473,7 @@ async fn password_login(
        // We still want the login to fail until they actually verified the email address
        err!(
            "Please verify your email before trying again.",
-            format!("IP: {}. Username: {username}.", ip.ip),
+            format!("IP: {}. Username: {log_username}.", ip.ip),
            ErrorEvent {
                event: EventType::UserFailedLogIn
            }
@@ -500,7 +482,7 @@ async fn password_login(

    let mut device = get_device(&data, conn, &user).await?;

-    let twofactor_token = twofactor_auth(&mut user, &data, &mut device, ip, client_version, conn).await?;
+    let twofactor_token = twofactor_auth(&mut user, &data, &mut device, ip, conn).await?;

    let auth_tokens = auth::AuthTokens::new(&device, &user, AuthMethod::Password, data.client_id);

@@ -583,7 +565,6 @@ async fn authenticated_response(
        "KdfIterations": user.client_kdf_iter,
        "KdfMemory": user.client_kdf_memory,
        "KdfParallelism": user.client_kdf_parallelism,
-        "ResetMasterPassword": false, // TODO: Same as above
        "ForcePasswordReset": false,
        "MasterPasswordPolicy": master_password_policy,
        "scope": auth_tokens.scope(),
@@ -737,7 +718,6 @@ async fn user_api_key_login(
        "KdfIterations": user.client_kdf_iter,
        "KdfMemory": user.client_kdf_memory,
        "KdfParallelism": user.client_kdf_parallelism,
-        "ResetMasterPassword": false, // TODO: according to official server seems something like: user.password_hash.is_empty(), but would need testing
        "ForcePasswordReset": false,
        "scope": AuthMethod::UserApiKey.scope(),
        "AccountKeys": account_keys,
@@ -803,7 +783,6 @@ async fn twofactor_auth(
    data: &ConnectData,
    device: &mut Device,
    ip: &ClientIp,
-    client_version: Option<&ClientVersion>,
    conn: &DbConn,
 ) -> ApiResult<Option<String>> {
    let twofactors = TwoFactor::find_by_user(&user.uuid, conn).await;
@@ -832,17 +811,12 @@ async fn twofactor_auth(
    if ![TwoFactorType::Remember as i32, TwoFactorType::RecoveryCode as i32].contains(&selected_id)
        && !twofactor_ids.contains(&selected_id)
    {
-        err_json!(
-            json_err_twofactor(&twofactor_ids, &user.uuid, data, client_version, conn).await?,
-            "Invalid two factor provider"
-        )
+        err_json!(json_err_twofactor(&twofactor_ids, &user.uuid, data, conn).await?, "Invalid two factor provider")
    }

-    let Some(ref twofactor_code) = data.two_factor_token else {
-        err_json!(
-            json_err_twofactor(&twofactor_ids, &user.uuid, data, client_version, conn).await?,
-            "2FA token not provided"
-        )
+    // Like upstream, a blank token counts as not provided
+    let Some(twofactor_code) = data.two_factor_token.as_deref().filter(|t| !t.trim().is_empty()) else {
+        err_json!(json_err_twofactor(&twofactor_ids, &user.uuid, data, conn).await?, "2FA token not provided")
    };

    let selected_twofactor = twofactors.into_iter().find(|tf| tf.atype == selected_id && tf.enabled);
@@ -856,20 +830,14 @@ async fn twofactor_auth(
        Some(TwoFactorType::Webauthn) => webauthn::validate_webauthn_login(&user.uuid, twofactor_code, conn).await?,
        Some(TwoFactorType::YubiKey) => yubikey::validate_yubikey_login(twofactor_code, &selected_data?).await?,
        Some(TwoFactorType::Duo) => {
-            if CONFIG.duo_use_iframe() {
-                // Legacy iframe prompt flow
-                duo::validate_duo_login(&user.email, twofactor_code, conn).await?;
-            } else {
-                // OIDC based flow
-                duo_oidc::validate_duo_login(
-                    &user.email,
-                    twofactor_code,
-                    data.client_id.as_ref().unwrap(),
-                    data.device_identifier.as_ref().unwrap(),
-                    conn,
-                )
-                .await?;
-            }
+            duo_oidc::validate_duo_login(
+                &user.email,
+                twofactor_code,
+                data.client_id.as_ref().unwrap(),
+                data.device_identifier.as_ref().unwrap(),
+                conn,
+            )
+            .await?;
        }
        Some(TwoFactorType::Email) => {
            email::validate_email_code_str(&user.uuid, twofactor_code, &selected_data?, &ip.ip, conn).await?;
@@ -891,7 +859,7 @@ async fn twofactor_auth(
                        device.save(true, conn).await?;
                    }
                    err_json!(
-                        json_err_twofactor(&twofactor_ids, &user.uuid, data, client_version, conn).await?,
+                        json_err_twofactor(&twofactor_ids, &user.uuid, data, conn).await?,
                        "2FA Remember token not provided or expired"
                    )
                }
@@ -946,7 +914,6 @@ async fn json_err_twofactor(
    providers: &[i32],
    user_id: &UserId,
    data: &ConnectData,
-    client_version: Option<&ClientVersion>,
    conn: &DbConn,
 ) -> ApiResult<Value> {
    let mut result = json!({
@@ -975,27 +942,17 @@ async fn json_err_twofactor(
                    err!("User does not exist")
                };

-                if CONFIG.duo_use_iframe() {
-                    // Legacy iframe prompt flow
-                    let (signature, host) = duo::generate_duo_signature(&email, conn).await?;
-                    result["TwoFactorProviders2"][provider.to_string()] = json!({
-                        "Host": host,
-                        "Signature": signature,
-                    });
-                } else {
-                    // OIDC based flow
-                    let auth_url = duo_oidc::get_duo_auth_url(
-                        &email,
-                        data.client_id.as_ref().unwrap(),
-                        data.device_identifier.as_ref().unwrap(),
-                        conn,
-                    )
-                    .await?;
+                let auth_url = duo_oidc::get_duo_auth_url(
+                    &email,
+                    data.client_id.as_ref().unwrap(),
+                    data.device_identifier.as_ref().unwrap(),
+                    conn,
+                )
+                .await?;

-                    result["TwoFactorProviders2"][provider.to_string()] = json!({
-                        "AuthUrl": auth_url,
-                    });
-                }
+                result["TwoFactorProviders2"][provider.to_string()] = json!({
+                    "AuthUrl": auth_url,
+                });
            }

            Some(tf_type @ TwoFactorType::YubiKey) => {
@@ -1015,19 +972,6 @@ async fn json_err_twofactor(
                    err!("No twofactor email registered")
                };

-                // Starting with version 2025.5.0 the client will call `/api/two-factor/send-email-login`.
-                let disabled_send = if let Some(cv) = client_version {
-                    let ver_match = semver::VersionReq::parse(">=2025.5.0").unwrap();
-                    ver_match.matches(&cv.0)
-                } else {
-                    false
-                };
-
-                // Send email immediately if email is the only 2FA option.
-                if providers.len() == 1 && !disabled_send {
-                    email::send_token(user_id, conn).await?;
-                }
-
                let email_data = email::EmailTokenData::from_json(&twofactor.data)?;
                result["TwoFactorProviders2"][provider.to_string()] = json!({
                    "Email": email::obscure_email(&email_data.email),
@@ -1065,11 +1009,6 @@ async fn prelogin_password(data: Json<PreloginData>, ip: ClientIp, conn: DbConn)
    prelogin(data, ip, conn).await
 }

-#[post("/accounts/register", data = "<data>")]
-async fn identity_register(data: Json<RegisterData>, conn: DbConn) -> JsonResult {
-    register(data, false, conn).await
-}
-
 #[derive(Debug, Deserialize)]
 #[serde(rename_all = "camelCase")]
 struct RegisterVerificationData {
@@ -1141,8 +1080,9 @@ async fn register_verification_email(
 }

 #[post("/accounts/register/finish", data = "<data>")]
-async fn register_finish(data: Json<RegisterData>, conn: DbConn) -> JsonResult {
-    register(data, true, conn).await
+async fn register_finish(data: Json<RegisterData>, ip: ClientIp, conn: DbConn) -> JsonResult {
+    crate::ratelimit::check_limit_unauthenticated(&ip.ip)?;
+    register(data, conn).await
 }

 // https://github.com/bitwarden/jslib/blob/master/common/src/models/request/tokenRequest.ts
@@ -89,6 +89,7 @@ fn vaultwarden_css() -> EtagCached<Css<String>> {

    // Else, there is either no cache, or reload_templates is true and we need to rebuild the CSS
    let css_options = json!({
+        "email_change_allowed": CONFIG.email_change_allowed(),
        "emergency_access_allowed": CONFIG.emergency_access_allowed(),
        "load_user_scss": true,
        "mail_2fa_enabled": CONFIG._enable_email_2fa(),
@@ -253,7 +253,7 @@ impl LoginJwtClaims {
            premium: true,
            name: user.name.clone(),
            email: user.email.clone(),
-            email_verified: !CONFIG.mail_enabled() || user.verified_at.is_some(),
+            email_verified: user.verified(),

            // ---
            // Disabled these keys to be added to the JWT since they could cause the JWT to get too large
@@ -75,7 +75,7 @@ impl SendTokens {
            return Self::invalid_error(&format!("Can't convert {access_id}"), "send_id_invalid", false);
        };

-        let Some(mut send) = Send::find_by_uuid(&send_id, conn).await else {
+        let Some(send) = Send::find_by_uuid(&send_id, conn).await else {
            return Self::invalid_error(&format!("Can't find {send_id}"), "send_id_invalid", false);
        };

@@ -103,10 +103,6 @@ impl SendTokens {
            }
        }

-        if !send.register_access(conn).await? {
-            return Self::invalid_error(&format!("Send {send_id}, max access reached"), "send_id_invalid", true);
-        }
-
        Ok(Self {
            access_claims: generate_send_access_claims(&send_id),
        })
@@ -561,7 +561,7 @@ make_config! {
        /// Auth Request cleanup schedule |> Cron schedule of the job that cleans old auth requests from the auth request.
        /// Defaults to every minute. Set blank to disable this job.
        auth_request_purge_schedule:   String, false,  def,    "30 * * * * *".to_owned();
-        /// Duo Auth context cleanup schedule |> Cron schedule of the job that cleans expired Duo contexts from the database. Does nothing if Duo MFA is disabled or set to use the legacy iframe prompt.
+        /// Duo Auth context cleanup schedule |> Cron schedule of the job that cleans expired Duo contexts from the database. Does nothing if Duo MFA is disabled.
        /// Defaults to once every minute. Set blank to disable this job.
        duo_context_purge_schedule:   String, false,  def,    "30 * * * * *".to_owned();
        /// Purge incomplete SSO auth. |> Cron schedule of the job that cleans leftover auth in db due to incomplete SSO login.
@@ -865,16 +865,12 @@ make_config! {
    duo: _enable_duo {
        /// Enabled
        _enable_duo:            bool,   true,   def,     true;
-        /// Attempt to use deprecated iframe-based Traditional Prompt (Duo WebSDK 2)
-        duo_use_iframe:         bool,   false,  def,     false;
        /// Client Id
        duo_ikey:               String, true,   option;
        /// Client Secret
        duo_skey:               Pass,   true,   option;
        /// Host
        duo_host:               String, true,   option;
-        /// Application Key (generated automatically)
-        _duo_akey:              Pass,   false,  option;
    },

    /// SMTP Email Settings
@@ -1418,29 +1414,21 @@ pub enum PathType {
 // Android (v2026.2.1): https://github.com/bitwarden/android/blob/6902c19c0093fa476bbf74ccaa70c9f14afbb82f/core/src/main/kotlin/com/bitwarden/core/data/manager/model/FlagKey.kt#L31
 // iOS (v2026.2.1): https://github.com/bitwarden/ios/blob/cdd9ba1770ca2ffc098d02d12cc3208e3a830454/BitwardenShared/Core/Platform/Models/Enum/FeatureFlag.swift#L7
 pub const SUPPORTED_FEATURE_FLAGS: &[&str] = &[
-    // Architecture
-    "desktop-ui-migration-milestone-1",
-    "desktop-ui-migration-milestone-2",
-    "desktop-ui-migration-milestone-3",
-    "desktop-ui-migration-milestone-4",
    // Auth Team
    "pm-5594-safari-account-switching",
    "pm-32413-multi-client-password-management",
    // Autofill Team
-    "ssh-agent",
+    "undetermined-cipher-scenario-logic",
+    "enable-basic-auth-response",
    "ssh-agent-v2",
    // Key Management Team
-    "ssh-key-vault-item",
-    "pm-25373-windows-biometrics-v2",
-    "pm-26340-linux-biometrics-v2",
+    "windows-native-credential-sync",
    // Mobile Team
-    "anon-addy-self-host-alias",
-    "simple-login-self-host-alias",
-    "mutual-tls",
-    "cxp-import-mobile",
-    "cxp-export-mobile",
+    "pm-34171-card-scanner",
    // Platform Team
    "pm-30529-webauthn-related-origins",
+    // Vault Team
+    "pm-32009-new-item-types",
 ];

 impl Config {
@@ -1512,15 +1500,6 @@ impl Config {
        Ok(())
    }

-    async fn update_config_partial(&self, other: ConfigBuilder) -> Result<(), Error> {
-        let builder = {
-            let usr = &self.inner.read().unwrap()._usr;
-            let mut overrides = Vec::new();
-            usr.merge(&other, false, &mut overrides)
-        };
-        self.update_config(builder, false).await
-    }
-
    /// Tests whether an email's domain is allowed. A domain is allowed if it
    /// is in signups_domains_whitelist, or if no whitelist is set (so there
    /// are no domain restrictions in effect).
@@ -1616,23 +1595,6 @@ impl Config {
        inner._enable_smtp && (inner.smtp_host.is_some() || inner.use_sendmail)
    }

-    pub async fn get_duo_akey(&self) -> String {
-        if let Some(akey) = self._duo_akey() {
-            akey
-        } else {
-            let akey_s = crate::crypto::encode_random_bytes::<64>(&data_encoding::BASE64);
-
-            // Save the new value
-            let builder = ConfigBuilder {
-                _duo_akey: Some(akey_s.clone()),
-                ..Default::default()
-            };
-            self.update_config_partial(builder).await.ok();
-
-            akey_s
-        }
-    }
-
    pub fn is_webauthn_2fa_supported(&self) -> bool {
        Url::parse(&self.domain()).expect("DOMAIN not a valid URL").domain().is_some()
    }
@@ -657,16 +657,27 @@ impl Cipher {
    }

    async fn get_user_collections_access_flags(&self, user_uuid: &UserId, conn: &DbConn) -> Vec<(bool, bool, bool)> {
+        let user_uuid = user_uuid.to_string();
        conn.run(move |conn| {
            // Check whether this cipher is in any collections accessible to the
            // user. If so, retrieve the access flags for each collection.
+            // The user must have a confirmed membership in the cipher's
+            // organization, since users_collections rows are kept when a
+            // membership is revoked or not confirmed yet.
            ciphers::table
                .filter(ciphers::uuid.eq(&self.uuid))
                .inner_join(ciphers_collections::table.on(ciphers::uuid.eq(ciphers_collections::cipher_uuid)))
+                .inner_join(
+                    users_organizations::table.on(ciphers::organization_uuid
+                        .eq(users_organizations::org_uuid.nullable())
+                        .and(users_organizations::user_uuid.eq(user_uuid))
+                        .and(users_organizations::status.eq(MembershipStatus::Confirmed as i32))),
+                )
                .inner_join(
                    users_collections::table.on(ciphers_collections::collection_uuid
                        .eq(users_collections::collection_uuid)
-                        .and(users_collections::user_uuid.eq(user_uuid))),
+                        // Only allow collection access via the confirmed membership.
+                        .and(users_organizations::user_uuid.eq(users_collections::user_uuid))),
                )
                .select((users_collections::read_only, users_collections::hide_passwords, users_collections::manage))
                .load::<(bool, bool, bool)>(conn)
@@ -697,6 +708,10 @@ impl Cipher {
                        .and(groups::organizations_uuid.eq(users_organizations::org_uuid))),
                )
                .filter(users_organizations::user_uuid.eq(user_uuid))
+                // Only allow group access via a confirmed membership, since
+                // groups_users rows are kept when a membership is revoked.
+                .filter(users_organizations::status.eq(MembershipStatus::Confirmed as i32))
+                .filter(ciphers::organization_uuid.eq(users_organizations::org_uuid.nullable()))
                .select((collections_groups::read_only, collections_groups::hide_passwords, collections_groups::manage))
                .load::<(bool, bool, bool)>(conn)
                .expect("Error getting group access restrictions")
@@ -989,6 +1004,7 @@ impl Cipher {
                            .eq(ciphers_collections::collection_uuid)
                            .and(collections_groups::groups_uuid.eq(groups::uuid))),
                    )
+                    .filter(users_organizations::status.eq(MembershipStatus::Confirmed as i32))
                    .filter(
                        users_organizations::access_all
                            .eq(true) // User has access all
@@ -1020,6 +1036,7 @@ impl Cipher {
                            .eq(ciphers_collections::collection_uuid)
                            .and(users_collections::user_uuid.eq(user_uuid.clone()))),
                    )
+                    .filter(users_organizations::status.eq(MembershipStatus::Confirmed as i32))
                    .filter(
                        users_organizations::access_all
                            .eq(true) // User has access all
@@ -1064,6 +1081,7 @@ impl Cipher {
                            .eq(ciphers_collections::collection_uuid)
                            .and(collections_groups::groups_uuid.eq(groups::uuid))),
                    )
+                    .filter(users_organizations::status.eq(MembershipStatus::Confirmed as i32))
                    .filter(
                        users_organizations::access_all
                            .eq(true) // User has access all
@@ -1096,6 +1114,7 @@ impl Cipher {
                            .eq(ciphers_collections::collection_uuid)
                            .and(users_collections::user_uuid.eq(user_uuid.clone()))),
                    )
+                    .filter(users_organizations::status.eq(MembershipStatus::Confirmed as i32))
                    .filter(
                        users_organizations::access_all
                            .eq(true) // User has access all
@@ -1147,6 +1166,7 @@ impl Cipher {
                .or_filter(users_organizations::atype.le(MembershipType::Admin as i32)) // User is admin or owner
                .or_filter(groups::access_all.eq(true)) //Access via group
                .or_filter(collections_groups::collections_uuid.is_not_null()) //Access via group
+                .filter(users_organizations::status.eq(MembershipStatus::Confirmed as i32))
                .select(ciphers_collections::all_columns)
                .distinct()
                .load::<(CipherId, CollectionId)>(conn)
@@ -367,6 +367,7 @@ impl Collection {
                            .and(collections_groups::collections_uuid.eq(collections::uuid))),
                    )
                    .filter(collections::uuid.eq(uuid))
+                    .filter(users_organizations::status.eq(MembershipStatus::Confirmed as i32))
                    .filter(
                        users_collections::collection_uuid
                            .eq(uuid)
@@ -406,6 +407,7 @@ impl Collection {
                            .and(users_organizations::user_uuid.eq(user_uuid))),
                    )
                    .filter(collections::uuid.eq(uuid))
+                    .filter(users_organizations::status.eq(MembershipStatus::Confirmed as i32))
                    .filter(users_collections::collection_uuid.eq(uuid).or(
                        // Directly accessed collection
                        users_organizations::access_all.eq(true).or(
@@ -430,7 +432,8 @@ impl Collection {
                    .inner_join(
                        users_organizations::table.on(collections::org_uuid
                            .eq(users_organizations::org_uuid)
-                            .and(users_organizations::user_uuid.eq(user_uuid.clone()))),
+                            .and(users_organizations::user_uuid.eq(user_uuid.clone()))
+                            .and(users_organizations::status.eq(MembershipStatus::Confirmed as i32))),
                    )
                    .left_join(
                        users_collections::table.on(users_collections::collection_uuid
@@ -476,7 +479,8 @@ impl Collection {
                    .inner_join(
                        users_organizations::table.on(collections::org_uuid
                            .eq(users_organizations::org_uuid)
-                            .and(users_organizations::user_uuid.eq(user_uuid.clone()))),
+                            .and(users_organizations::user_uuid.eq(user_uuid.clone()))
+                            .and(users_organizations::status.eq(MembershipStatus::Confirmed as i32))),
                    )
                    .left_join(
                        users_collections::table.on(users_collections::collection_uuid
@@ -527,6 +531,7 @@ impl Collection {
                        .and(collections_groups::collections_uuid.eq(collections::uuid))),
                )
                .filter(collections::uuid.eq(&self.uuid))
+                .filter(users_organizations::status.eq(MembershipStatus::Confirmed as i32))
                .filter(
                    users_collections::collection_uuid
                        .eq(&self.uuid)
@@ -586,6 +591,7 @@ impl Collection {
                        .and(collections_groups::collections_uuid.eq(collections::uuid))),
                )
                .filter(collections::uuid.eq(&uuid))
+                .filter(users_organizations::status.eq(MembershipStatus::Confirmed as i32))
                .filter(
                    users_collections::collection_uuid
                        .eq(&uuid)
@@ -650,6 +656,7 @@ impl Collection {
                        .and(collections_groups::collections_uuid.eq(collections::uuid))),
                )
                .filter(collections::org_uuid.eq(&org_uuid))
+                .filter(users_organizations::status.eq(MembershipStatus::Confirmed as i32))
                .filter(
                    // Manage permission on a collection assigned directly or via a group.
                    users_collections::manage.eq(true).or(collections_groups::manage.eq(true)),
@@ -819,10 +826,18 @@ impl CollectionUser {
        .await
    }

+    // Only returns the collections of organizations the user is a confirmed member of
    pub async fn find_by_user(user_uuid: &UserId, conn: &DbConn) -> Vec<Self> {
        conn.run(move |conn| {
            users_collections::table
+                .inner_join(collections::table.on(collections::uuid.eq(users_collections::collection_uuid)))
+                .inner_join(
+                    users_organizations::table.on(users_organizations::org_uuid
+                        .eq(collections::org_uuid)
+                        .and(users_organizations::user_uuid.eq(users_collections::user_uuid))),
+                )
                .filter(users_collections::user_uuid.eq(user_uuid))
+                .filter(users_organizations::status.eq(MembershipStatus::Confirmed as i32))
                .select(users_collections::all_columns)
                .load::<Self>(conn)
                .expect("Error loading users_collections")
@@ -113,7 +113,7 @@ pub enum EventType {
    OrganizationUserAdminResetTwoFactor = 1519,
    // OrganizationUserRevoked_TwoFactorNonCompliance = 1520,
    // OrganizationUserRevoked_SingleOrganizationNonCompliance = 1521,
-    // OrganizationUserNotificationBannerActionClicked = 1522,
+    OrganizationUserNotificationBannerActionClicked = 1522,

    // Organization
    OrganizationUpdated = 1600,
@@ -13,7 +13,7 @@ use crate::{
 };
 use macros::UuidFromParam;

-use super::{CollectionId, Membership, MembershipId, OrganizationId, User, UserId};
+use super::{CollectionId, Membership, MembershipId, MembershipStatus, OrganizationId, User, UserId};

 #[derive(Identifiable, Queryable, Insertable, AsChangeset)]
 #[diesel(table_name = groups)]
@@ -104,7 +104,6 @@ impl Group {
            "id": self.uuid,
            "organizationId": self.organizations_uuid,
            "name": self.name,
-            "accessAll": self.access_all,
            "externalId": self.external_id,
            "collections": collections_groups,
            "object": "groupDetails"
@@ -249,6 +248,7 @@ impl Group {
                        .and(groups::organizations_uuid.eq(users_organizations::org_uuid))),
                )
                .filter(users_organizations::user_uuid.eq(user_uuid))
+                .filter(users_organizations::status.eq(MembershipStatus::Confirmed as i32))
                .filter(groups::access_all.eq(true))
                .select(groups::organizations_uuid)
                .distinct()
@@ -268,6 +268,9 @@ impl Group {
                        .and(users_organizations::org_uuid.eq(groups::organizations_uuid))),
                )
                .filter(users_organizations::user_uuid.eq(user_uuid))
+                // Only allow full access via a confirmed membership, since
+                // groups_users rows are kept when a membership is revoked.
+                .filter(users_organizations::status.eq(MembershipStatus::Confirmed as i32))
                .filter(groups::organizations_uuid.eq(org_uuid))
                .filter(groups::access_all.eq(true))
                .select(groups::access_all)
@@ -384,6 +387,7 @@ impl CollectionGroup {
                        .and(collections::org_uuid.eq(groups::organizations_uuid))),
                )
                .filter(users_organizations::user_uuid.eq(user_uuid))
+                .filter(users_organizations::status.eq(MembershipStatus::Confirmed as i32))
                .select(collections_groups::all_columns)
                .load::<Self>(conn)
                .expect("Error loading user collection groups")
@@ -569,26 +573,6 @@ impl GroupUser {
        }
    }

-    pub async fn delete_by_group_and_member(
-        group_uuid: &GroupId,
-        member_uuid: &MembershipId,
-        conn: &DbConn,
-    ) -> EmptyResult {
-        match Membership::find_by_uuid(member_uuid, conn).await {
-            Some(member) => User::update_uuid_revision(&member.user_uuid, conn).await,
-            None => warn!("Member could not be found!"),
-        }
-
-        conn.run(move |conn| {
-            diesel::delete(groups_users::table)
-                .filter(groups_users::groups_uuid.eq(group_uuid))
-                .filter(groups_users::users_organizations_uuid.eq(member_uuid))
-                .execute(conn)
-                .map_res("Error deleting group users")
-        })
-        .await
-    }
-
    pub async fn delete_all_by_group(group_uuid: &GroupId, org_uuid: &OrganizationId, conn: &DbConn) -> EmptyResult {
        let group_users = GroupUser::find_by_group(group_uuid, org_uuid, conn).await;
        for group_user in group_users {
@@ -39,4 +39,4 @@ pub use self::sso_auth::{OIDCAuthenticatedUser, OIDCCodeResponseError, SsoAuth};
 pub use self::two_factor::{TwoFactor, TwoFactorType};
 pub use self::two_factor_duo_context::TwoFactorDuoContext;
 pub use self::two_factor_incomplete::TwoFactorIncomplete;
-pub use self::user::{Invitation, SsoUser, User, UserId, UserKdfType, UserStampException};
+pub use self::user::{Invitation, KeyId, SsoUser, User, UserId, UserKdfType, UserStampException};
@@ -49,6 +49,7 @@ pub enum OrgPolicyType {
    // AutotypeDefaultSetting = 17, // Not supported yet
    // AutoConfirm = 18, // Not supported (not implemented yet)
    // BlockClaimedDomainAccountCreation = 19, // Not supported (Not AGPLv3 Licensed)
+    OrganizationUserNotification = 20,
 }

 // https://github.com/bitwarden/server/blob/9ebe16587175b1c0e9208f84397bb75d0d595510/src/Core/AdminConsole/Models/Data/Organizations/Policies/SendOptionsPolicyData.cs#L5
@@ -186,6 +187,26 @@ impl OrgPolicy {
        .await
    }

+    pub async fn find_accepted_and_confirmed_by_user(user_uuid: &UserId, conn: &DbConn) -> Vec<Self> {
+        conn.run(move |conn| {
+            org_policies::table
+                .inner_join(
+                    users_organizations::table.on(users_organizations::org_uuid
+                        .eq(org_policies::org_uuid)
+                        .and(users_organizations::user_uuid.eq(user_uuid))),
+                )
+                .filter(
+                    users_organizations::status
+                        .eq(MembershipStatus::Accepted as i32)
+                        .or(users_organizations::status.eq(MembershipStatus::Confirmed as i32)),
+                )
+                .select(org_policies::all_columns)
+                .load::<Self>(conn)
+                .expect("Error loading org_policy")
+        })
+        .await
+    }
+
    pub async fn find_by_org_and_type(
        org_uuid: &OrganizationId,
        policy_type: OrgPolicyType,
@@ -1,7 +1,4 @@
-use std::{
-    cmp::Ordering,
-    collections::{HashMap, HashSet},
-};
+use std::cmp::Ordering;

 use chrono::{NaiveDateTime, Utc};
 use derive_more::{AsRef, Deref, Display, From};
@@ -24,8 +21,8 @@ use crate::{
 use macros::UuidFromParam;

 use super::{
-    Cipher, CipherId, Collection, CollectionGroup, CollectionId, CollectionUser, Group, GroupId, GroupUser, OrgPolicy,
-    OrgPolicyType, TwoFactor, User, UserId,
+    Cipher, CipherId, Collection, CollectionId, CollectionUser, Group, GroupId, GroupUser, OrgPolicy, OrgPolicyType,
+    TwoFactor, User, UserId,
 };

 #[derive(Identifiable, Queryable, Insertable, AsChangeset)]
@@ -518,8 +515,7 @@ impl Membership {
            "limitCollectionDeletion": true,
            "limitItemDeletion": false,
            "allowAdminAccessToAllCollectionItems": true,
-            "userIsManagedByOrganization": false, // Means not managed via the Members UI, like SSO
-            "userIsClaimedByOrganization": false, // The new key instead of the obsolete userIsManagedByOrganization
+            "userIsClaimedByOrganization": false, // Means not managed via the Members UI, like SSO

            "permissions": permissions,

@@ -536,7 +532,13 @@ impl Membership {
        })
    }

-    pub async fn to_json_user_details(&self, include_collections: bool, include_groups: bool, conn: &DbConn) -> Value {
+    // Used by admins to view other members, so nothing here may depend on this member's status
+    pub async fn to_json_details_for_admin(
+        &self,
+        include_collections: bool,
+        include_groups: bool,
+        conn: &DbConn,
+    ) -> Value {
        let user = User::find_by_uuid(&self.user_uuid, conn).await.unwrap();

        // Because BitWarden want the status to be -1 for revoked users we need to catch that here.
@@ -559,52 +561,23 @@ impl Membership {

        // Check if a user is in a group which has access to all collections
        // If that is the case, we should not return individual collections!
+        // This is used by admins to view other members, so it must not depend on the membership status
        let full_access_group =
-            CONFIG.org_groups_enabled() && Group::is_in_full_access_group(&self.user_uuid, &self.org_uuid, conn).await;
+            CONFIG.org_groups_enabled() && GroupUser::has_full_access_by_member(&self.org_uuid, &self.uuid, conn).await;

        // If collections are to be included, only include them if the user does not have full access via a group or defined to the user it self
+        // Only the collections assigned directly are returned, the ones assigned via a group are returned via a special group endpoint
        let collections: Vec<Value> = if include_collections && !(full_access_group || self.access_all) {
-            // Get all collections for the user here already to prevent more queries
-            let cu: HashMap<CollectionId, CollectionUser> =
-                CollectionUser::find_by_organization_and_user_uuid(&self.org_uuid, &self.user_uuid, conn)
-                    .await
-                    .into_iter()
-                    .map(|cu| (cu.collection_uuid.clone(), cu))
-                    .collect();
-
-            // Get all collection groups for this user to prevent there inclusion
-            let cg: HashSet<CollectionId> = CollectionGroup::find_by_user(&self.user_uuid, conn)
+            CollectionUser::find_by_organization_and_user_uuid(&self.org_uuid, &self.user_uuid, conn)
                .await
                .into_iter()
-                .map(|cg| cg.collections_uuid)
-                .collect();
-
-            Collection::find_by_organization_and_user_uuid(&self.org_uuid, &self.user_uuid, conn)
-                .await
-                .into_iter()
-                .filter_map(|c| {
-                    let (read_only, hide_passwords, manage) = if self.has_full_access() {
-                        (false, false, self.atype >= MembershipType::Manager)
-                    } else if let Some(cu) = cu.get(&c.uuid) {
-                        (
-                            cu.read_only,
-                            cu.hide_passwords,
-                            cu.manage || (self.atype == MembershipType::Manager && !cu.read_only && !cu.hide_passwords),
-                        )
-                    // If previous checks failed it might be that this user has access via a group, but we should not return those elements here
-                    // Those are returned via a special group endpoint
-                    } else if cg.contains(&c.uuid) {
-                        return None;
-                    } else {
-                        (true, true, false)
-                    };
-
-                    Some(json!({
-                        "id": c.uuid,
-                        "readOnly": read_only,
-                        "hidePasswords": hide_passwords,
-                        "manage": manage,
-                    }))
+                .map(|cu| {
+                    json!({
+                        "id": cu.collection_uuid,
+                        "readOnly": cu.read_only,
+                        "hidePasswords": cu.hide_passwords,
+                        "manage": cu.manage || (self.atype == MembershipType::Manager && !cu.read_only && !cu.hide_passwords),
+                    })
                })
                .collect()
        } else {
@@ -652,7 +625,6 @@ impl Membership {

            "status": status,
            "type": membership_type,
-            "accessAll": self.access_all,
            "twoFactorEnabled": twofactor_enabled,
            "resetPasswordEnrolled": self.reset_password_key.is_some(),
            "hasMasterPassword": !user.password_hash.is_empty(),
@@ -660,7 +632,6 @@ impl Membership {
            "permissions": permissions,

            "ssoBound": false, // Not supported
-            "managedByOrganization": false, // This key is obsolete replaced by claimedByOrganization
            "claimedByOrganization": false, // Means not managed via the Members UI, like SSO
            "usesKeyConnector": false, // Not supported
            "accessSecretsManager": false, // Not supported (Not AGPLv3 Licensed)
@@ -711,7 +682,6 @@ impl Membership {

            "status": status,
            "type": self.atype,
-            "accessAll": self.access_all,
            "collections": coll_uuids,

            "object": "organizationUserDetails",
@@ -844,6 +814,21 @@ impl Membership {
        .await
    }

+    pub async fn find_accepted_and_confirmed_by_user(user_uuid: &UserId, conn: &DbConn) -> Vec<Self> {
+        conn.run(move |conn| {
+            users_organizations::table
+                .filter(users_organizations::user_uuid.eq(user_uuid))
+                .filter(
+                    users_organizations::status
+                        .eq(MembershipStatus::Accepted as i32)
+                        .or(users_organizations::status.eq(MembershipStatus::Confirmed as i32)),
+                )
+                .load::<Self>(conn)
+                .unwrap_or_default()
+        })
+        .await
+    }
+
    pub async fn find_invited_by_user(user_uuid: &UserId, conn: &DbConn) -> Vec<Self> {
        conn.run(move |conn| {
            users_organizations::table
@@ -1017,17 +1002,6 @@ impl Membership {
        .await
    }

-    pub async fn get_orgs_by_user(user_uuid: &UserId, conn: &DbConn) -> Vec<OrganizationId> {
-        conn.run(move |conn| {
-            users_organizations::table
-                .filter(users_organizations::user_uuid.eq(user_uuid))
-                .select(users_organizations::org_uuid)
-                .load::<OrganizationId>(conn)
-                .unwrap_or_default()
-        })
-        .await
-    }
-
    pub async fn find_by_user_and_policy(user_uuid: &UserId, policy_type: OrgPolicyType, conn: &DbConn) -> Vec<Self> {
        conn.run(move |conn| {
            users_organizations::table
@@ -1050,6 +1024,7 @@ impl Membership {
        conn.run(move |conn| {
            users_organizations::table
                .filter(users_organizations::org_uuid.eq(org_uuid))
+                .filter(users_organizations::status.eq(MembershipStatus::Confirmed as i32))
                .left_join(users_collections::table.on(users_collections::user_uuid.eq(users_organizations::user_uuid)))
                .left_join(
                    ciphers_collections::table.on(ciphers_collections::collection_uuid
@@ -1076,6 +1051,7 @@ impl Membership {
        conn.run(move |conn| {
            users_organizations::table
                .filter(users_organizations::org_uuid.eq(org_uuid))
+                .filter(users_organizations::status.eq(MembershipStatus::Confirmed as i32))
                .inner_join(
                    groups_users::table.on(groups_users::users_organizations_uuid.eq(users_organizations::uuid)),
                )
@@ -1111,6 +1087,7 @@ impl Membership {
                        .and(ciphers::organization_uuid.eq(users_organizations::org_uuid.nullable()))),
                )
                .filter(users_organizations::user_uuid.eq(user_uuid))
+                .filter(users_organizations::status.eq(MembershipStatus::Confirmed as i32))
                .filter(
                    users_organizations::atype.eq_any(vec![MembershipType::Owner as i32, MembershipType::Admin as i32]),
                )
@@ -140,6 +140,10 @@ impl Send {
        None
    }

+    fn access_id(&self) -> String {
+        BASE64URL_NOPAD.encode(Uuid::parse_str(&self.uuid).unwrap_or_default().as_bytes())
+    }
+
    pub fn to_json(&self) -> Value {
        let mut data = serde_json::from_str::<LowerCase<Value>>(&self.data).map(|d| d.data).unwrap_or_default();

@@ -150,7 +154,7 @@ impl Send {

        json!({
            "id": self.uuid,
-            "accessId": BASE64URL_NOPAD.encode(Uuid::parse_str(&self.uuid).unwrap_or_default().as_bytes()),
+            "accessId": self.access_id(),
            "type": self.atype,

            "name": self.name,
@@ -182,7 +186,7 @@ impl Send {
        }

        json!({
-            "id": self.uuid,
+            "id": self.access_id(),
            "type": self.atype,

            "name": self.name,
@@ -256,7 +260,7 @@ impl Send {

    /// Whether the Send is currently within its validity window: not disabled, not past its
    /// expiration date, and not past its deletion date. Does not consider `max_access_count`
-    /// (consumed at token issuance) or the password.
+    /// (counted on each access) or the password.
    pub fn is_accessible(&self) -> bool {
        let now = Utc::now().naive_utc();
        if self.disabled {
@@ -309,19 +313,6 @@ impl Send {
        Ok(())
    }

-    pub async fn find_by_access_id(access_id: &str, conn: &DbConn) -> Option<Self> {
-        let Ok(uuid_vec) = BASE64URL_NOPAD.decode(access_id.as_bytes()) else {
-            return None;
-        };
-
-        let uuid = match Uuid::from_slice(&uuid_vec) {
-            Ok(u) => SendId::from(u.to_string()),
-            Err(_) => return None,
-        };
-
-        Self::find_by_uuid(&uuid, conn).await
-    }
-
    pub async fn find_by_uuid(uuid: &SendId, conn: &DbConn) -> Option<Self> {
        conn.run(move |conn| sends::table.filter(sends::uuid.eq(uuid)).first::<Self>(conn).ok()).await
    }
@@ -361,13 +352,6 @@ impl Send {
        Some(total)
    }

-    pub async fn find_by_org(org_uuid: &OrganizationId, conn: &DbConn) -> Vec<Self> {
-        conn.run(move |conn| {
-            sends::table.filter(sends::organization_uuid.eq(org_uuid)).load::<Self>(conn).expect("Error loading sends")
-        })
-        .await
-    }
-
    pub async fn find_by_past_deletion_date(conn: &DbConn) -> Vec<Self> {
        let now = Utc::now().naive_utc();
        conn.run(move |conn| {
@@ -69,6 +69,8 @@ pub struct User {
    pub avatar_color: Option<String>,

    pub external_id: Option<String>, // Todo: Needs to be removed in the future, this is not used anymore.
+
+    pub key_id: Option<KeyId>,
 }

 #[derive(Identifiable, Queryable, Insertable)]
@@ -154,6 +156,8 @@ impl User {
            avatar_color: None,

            external_id: None, // Todo: Needs to be removed in the future, this is not used anymore.
+
+            key_id: None,
        }
    }

@@ -253,12 +257,21 @@ impl User {

 /// Database methods
 impl User {
+    pub fn verified(&self) -> bool {
+        !CONFIG.mail_enabled() || self.verified_at.is_some()
+    }
+
    pub async fn to_json(&self, conn: &DbConn) -> Value {
        let mut orgs_json = Vec::new();
        for c in Membership::find_confirmed_by_user(&self.uuid, conn).await {
            orgs_json.push(c.to_json(conn).await);
        }

+        let mut orgs_new_json = Vec::new();
+        for c in Membership::find_accepted_and_confirmed_by_user(&self.uuid, conn).await {
+            orgs_new_json.push(c.to_json(conn).await);
+        }
+
        let twofactor_enabled = !TwoFactor::find_by_user(&self.uuid, conn).await.is_empty();

        // TODO: Might want to save the status field in the DB
@@ -290,7 +303,7 @@ impl User {
            "id": self.uuid,
            "name": self.name,
            "email": self.email,
-            "emailVerified": !CONFIG.mail_enabled() || self.verified_at.is_some(),
+            "emailVerified": self.verified(),
            "premium": true,
            "premiumFromOrganization": false,
            "culture": "en-US",
@@ -299,6 +312,7 @@ impl User {
            "privateKey": self.private_key,
            "securityStamp": self.security_stamp,
            "organizations": orgs_json,
+            "organizationsNew": orgs_new_json,
            "providers": [],
            "providerOrganizations": [],
            "forcePasswordReset": false,
@@ -527,6 +541,26 @@ impl Invitation {
 #[from(forward)]
 pub struct UserId(String);

+#[derive(
+    Clone,
+    Debug,
+    DieselNewType,
+    FromForm,
+    PartialEq,
+    Eq,
+    Hash,
+    Serialize,
+    Deserialize,
+    AsRef,
+    Deref,
+    Display,
+    From,
+    UuidFromParam,
+)]
+#[deref(forward)]
+#[from(forward)]
+pub struct KeyId(String);
+
 impl SsoUser {
    pub async fn save(&self, conn: &DbConn) -> EmptyResult {
        db_run! { conn:
@@ -217,6 +217,7 @@ table! {
        api_key -> Nullable<Text>,
        avatar_color -> Nullable<Text>,
        external_id -> Nullable<Text>,
+        key_id -> Nullable<Text>,
    }
 }

@@ -466,7 +466,7 @@ mod tests {
    #[test]
    fn dotted_decimal_loopback_normalizes() {
        let ip = parse_to_ip("127.0.0.1").unwrap();
-        assert_eq!(ip, IpAddr::V4(Ipv4Addr::new(127, 0, 0, 1)));
+        assert_eq!(ip, IpAddr::V4(Ipv4Addr::LOCALHOST));
        assert!(!is_global_hardcoded(ip));
    }

@@ -474,21 +474,21 @@ mod tests {
    fn single_decimal_loopback_normalizes() {
        // 127.0.0.1 == 2130706433
        let ip = parse_to_ip("2130706433").unwrap();
-        assert_eq!(ip, IpAddr::V4(Ipv4Addr::new(127, 0, 0, 1)));
+        assert_eq!(ip, IpAddr::V4(Ipv4Addr::LOCALHOST));
        assert!(!is_global_hardcoded(ip));
    }

    #[test]
    fn hex_loopback_normalizes() {
        let ip = parse_to_ip("0x7f000001").unwrap();
-        assert_eq!(ip, IpAddr::V4(Ipv4Addr::new(127, 0, 0, 1)));
+        assert_eq!(ip, IpAddr::V4(Ipv4Addr::LOCALHOST));
        assert!(!is_global_hardcoded(ip));
    }

    #[test]
    fn dotted_hex_loopback_normalizes() {
        let ip = parse_to_ip("0x7f.0.0.1").unwrap();
-        assert_eq!(ip, IpAddr::V4(Ipv4Addr::new(127, 0, 0, 1)));
+        assert_eq!(ip, IpAddr::V4(Ipv4Addr::LOCALHOST));
        assert!(!is_global_hardcoded(ip));
    }

@@ -496,14 +496,14 @@ mod tests {
    fn octal_loopback_normalizes() {
        // 017700000001 == 127.0.0.1
        let ip = parse_to_ip("017700000001").unwrap();
-        assert_eq!(ip, IpAddr::V4(Ipv4Addr::new(127, 0, 0, 1)));
+        assert_eq!(ip, IpAddr::V4(Ipv4Addr::LOCALHOST));
        assert!(!is_global_hardcoded(ip));
    }

    #[test]
    fn dotted_octal_loopback_normalizes() {
        let ip = parse_to_ip("0177.0.0.01").unwrap();
-        assert_eq!(ip, IpAddr::V4(Ipv4Addr::new(127, 0, 0, 1)));
+        assert_eq!(ip, IpAddr::V4(Ipv4Addr::LOCALHOST));
        assert!(!is_global_hardcoded(ip));
    }

@@ -535,19 +535,19 @@ mod tests {
    #[test]
    fn get_valid_host_normalizes_decimal_int() {
        let h = get_valid_host("2130706433").expect("valid");
-        assert!(matches!(h, Host::Ipv4(ip) if ip == Ipv4Addr::new(127, 0, 0, 1)));
+        assert!(matches!(h, Host::Ipv4(ip) if ip == Ipv4Addr::LOCALHOST));
    }

    #[test]
    fn get_valid_host_normalizes_hex() {
        let h = get_valid_host("0x7f000001").expect("valid");
-        assert!(matches!(h, Host::Ipv4(ip) if ip == Ipv4Addr::new(127, 0, 0, 1)));
+        assert!(matches!(h, Host::Ipv4(ip) if ip == Ipv4Addr::LOCALHOST));
    }

    #[test]
    fn get_valid_host_normalizes_octal() {
        let h = get_valid_host("017700000001").expect("valid");
-        assert!(matches!(h, Host::Ipv4(ip) if ip == Ipv4Addr::new(127, 0, 0, 1)));
+        assert!(matches!(h, Host::Ipv4(ip) if ip == Ipv4Addr::LOCALHOST));
    }

    // ===
@@ -720,7 +720,7 @@ fn schedule_jobs(pool: db::DbPool) {
            }

            // Clean unused, expired Duo authentication contexts.
-            if !CONFIG.duo_context_purge_schedule().is_empty() && CONFIG._enable_duo() && !CONFIG.duo_use_iframe() {
+            if !CONFIG.duo_context_purge_schedule().is_empty() && CONFIG._enable_duo() {
                sched.add(Job::new(CONFIG.duo_context_purge_schedule().parse().unwrap(), || {
                    runtime.spawn(purge_duo_contexts(pool.clone()));
                }));
@@ -4,10 +4,10 @@
 *
 * To rebuild or modify this file with the latest versions of the included
 * software please visit:
- *   https://datatables.net/download/#bs5/dt-3.0.3
+ *   https://datatables.net/download/#bs5/dt-3.0.4
 *
 * Included libraries:
- *   DataTables 3.0.3
+ *   DataTables 3.0.4
 */

 /*! DataTables Bootstrap 5 integration
@@ -636,6 +636,18 @@ table.dataTable.table-sm > thead > tr td.dt-type-date .dt-column-order,
 table.dataTable.table-sm > thead > tr td.dt-type-numeric .dt-column-order {
  left: 0.25rem;
 }
+table.dataTable.table-sm > thead > tr th.dt-left .dt-column-order, table.dataTable.table-sm > thead > tr th.dt-head-left .dt-column-order,
+table.dataTable.table-sm > thead > tr td.dt-left .dt-column-order,
+table.dataTable.table-sm > thead > tr td.dt-head-left .dt-column-order {
+  left: auto;
+  right: 0.25rem;
+}
+table.dataTable.table-sm > thead > tr th.dt-right .dt-column-order, table.dataTable.table-sm > thead > tr th.dt-head-right .dt-column-order,
+table.dataTable.table-sm > thead > tr td.dt-right .dt-column-order,
+table.dataTable.table-sm > thead > tr td.dt-head-right .dt-column-order {
+  left: 0.25rem;
+  right: auto;
+}

 div.dt-scroll-head table.table-bordered {
  border-bottom-width: 0;
@@ -42,45 +42,27 @@ a[href$="/settings/sponsored-families"] {
 {{/if}}

 /* Hide the `Enterprise Single Sign-On` button on the login page */
-{{#if (webver ">=2025.5.1")}}
 {{#if (not sso_enabled)}}
 .vw-sso-login {
  @extend %vw-hide;
 }
 {{/if}}
-{{else}}
-app-root ng-component > form > div:nth-child(1) > div > button[buttontype="secondary"].\!tw-text-primary-600:nth-child(4) {
-  @extend %vw-hide;
-}
-{{/if}}

 /* Hide the `Log in with passkey` settings */
 app-user-layout app-password-settings app-webauthn-login-settings {
  @extend %vw-hide;
 }
 /* Hide Log in with passkey on the login page */
-{{#if (webver ">=2025.5.1")}}
 .vw-passkey-login {
  @extend %vw-hide;
 }
-{{else}}
-app-root ng-component > form > div:nth-child(1) > div > button[buttontype="secondary"].\!tw-text-primary-600:nth-child(3) {
-  @extend %vw-hide;
-}
-{{/if}}

 /* Hide the or text followed by the two buttons hidden above */
-{{#if (webver ">=2025.5.1")}}
 {{#if (or (not sso_enabled) sso_only)}}
 .vw-or-text {
  @extend %vw-hide;
 }
 {{/if}}
-{{else}}
-app-root ng-component > form > div:nth-child(1) > div:nth-child(3) > div:nth-child(2) {
-  @extend %vw-hide;
-}
-{{/if}}

 /* Hide the `Other` button on the login page */
 {{#if (or (not sso_enabled) sso_only)}}
@@ -154,17 +136,10 @@ ng-dropdown-panel div.ng-dropdown-panel-items div:has(> [title="DuckDuckGo"]) {
  take a while for the change to take effect. To avoid the button appearing
  when it shouldn't, we'll keep this style in place for a couple of versions */
 /* Hide the register link on the login screen */
-{{#if (webver "<2025.3.0")}}
-app-login form div + div + div + div + hr,
-app-login form div + div + div + div + hr + p {
-  @extend %vw-hide;
-}
-{{else}}
 app-root a[routerlink="/signup"] {
  @extend %vw-hide;
 }
 {{/if}}
-{{/if}}

 {{#if remember_2fa_disabled}}
 /* Hide checkbox to remember 2FA token for 30 days */
@@ -220,6 +195,13 @@ auth-input-password > form > bit-form-field:nth-child(4) {
  @extend %vw-hide;
 }
 {{/unless}}
+
+{{#unless email_change_allowed}}
+/* Hide the whole `Change email` section, including its heading, if not allowed */
+div:has(> app-change-email) {
+  @extend %vw-hide;
+}
+{{/unless}}
 /**** End Dynamic Vaultwarden Changes ****/
 /**** Include a special user stylesheet for custom changes ****/
 {{#if load_user_scss}}
@@ -943,15 +943,15 @@ mod tests {
    use std::net::IpAddr;

    #[test]
-    #[ignore]
+    #[ignore = "exhaustive IPv4 check is too slow for the regular test suite"]
    fn test_ipv4_global() {
        for a in 0..u8::MAX {
-            println!("Iter: {}/255", a);
+            println!("Iter: {a}/255");
            for b in 0..u8::MAX {
                for c in 0..u8::MAX {
                    for d in 0..u8::MAX {
                        let ip = IpAddr::V4(std::net::Ipv4Addr::new(a, b, c, d));
-                        assert_eq!(ip.is_global(), is_global_hardcoded(ip), "IP mismatch: {}", ip)
+                        assert_eq!(ip.is_global(), is_global_hardcoded(ip), "IP mismatch: {ip}");
                    }
                }
            }
@@ -959,15 +959,15 @@ mod tests {
    }

    #[test]
-    #[ignore]
+    #[ignore = "random IPv6 check is too slow for the regular test suite"]
    fn test_ipv6_global() {
-        use rand::Rng;
+        use rand::RngExt;

        std::thread::scope(|s| {
            for t in 0..16 {
-                let handle = s.spawn(move || {
+                let _handle = s.spawn(move || {
                    let mut v = [0u8; 16];
-                    let mut rng = rand::thread_rng();
+                    let mut rng = rand::rng();

                    for i in 0..20 {
                        println!("Thread {t} Iter: {i}/50");
Author	SHA1	Message	Date
Daniel García	1f99d9d276	Remove legacy API endpoints and compatibility code dropped upstream (#7809 ) Remove endpoints, response fields, feature flags and compatibility code that upstream Bitwarden has removed and that no current client uses: - Legacy POST /identity/accounts/register and POST /api/accounts/prelogin; register/finish is rate limited like the other unauthenticated endpoints. - Legacy organization routes: PUT groups/{id}/users, PUT policies/{type}/vnext, PUT users/{id}/reset-password, GET billing/metadata, and the POST aliases of the organization, collection, group and member PUT/DELETE routes. - POST /two-factor/disable (PUT stays). - ResetMasterPassword, captchaBypassToken, the legacy registration name field, userIsManagedByOrganization/managedByOrganization and accessAll. - The automatic email 2FA code for clients older than 2025.5.0. - DUO_USE_IFRAME and the Duo Traditional Prompt code. - Experimental client feature flags that no client reads anymore. - Web vault CSS selectors for web vaults older than 2025.5.1. Also accept the PascalCase fields Android 2026.9.0+ sends on registration and password change, and align a few account, login/2FA and organization checks with upstream. Adds tests for the registration body formats.	2026-10-04 22:16:55 +02:00
Daniel García	f4f1a8e105	Send API cleanup: remove legacy endpoints and align access with upstream (#7806 )	2026-10-03 23:05:56 +02:00
Timshel Timshel Mathijs van Veluw	1c89e1772b	2fa email fallback need a verified email (#7770 ) Co-authored-by: Timshel <timshel@users.noreply.github.com> Co-authored-by: Mathijs van Veluw <black.dex@gmail.com>	2026-10-03 14:01:26 +02:00
Tom	3714b504f6	Fix Clippy warnings across all targets (#7782 )	2026-10-03 13:50:29 +02:00
Tom	f9f011d50c	Hide the whole change-email section when EMAIL_CHANGE_ALLOWED is false (#7759 )	2026-10-03 13:49:53 +02:00
Julian Speckmann	cb89088bc3	Add Windows native credential sync to supported feature flags (#7798 )	2026-10-03 13:49:44 +02:00
Pier Carlo Cadoppi	4444442075	Add `undetermined-cipher-scenario-logic` feature flag (#7802 ) Introduced in Browser 2026.2.0 via bitwarden/clients#18395. Rewrites the post-submit add/update login notification triggering logic, deferring cipher-type inference until the vault is unlocked. Client-side only.	2026-10-03 13:49:37 +02:00
Mathijs van Veluw	061694d0cb	Fix cortex-a53 build issues when using xx-cargo (#7774 ) When using xx-cargo it uses a different linker then the default one. This causes some default fixes Debian/Ubuntu add for the Cortex-A53 architectures to not be included. This commit fixes that by checking if the target architecture is arm64 and if so, will add the needed fix argument. This should prevent issues reported here #7754. We can not say this with 100% certainty since this bug sometimes appears and sometimes it does not. Fixes #7754 Signed-off-by: BlackDex <black.dex@gmail.com>	2026-09-25 21:53:06 +02:00
Daniel García	32098ca7d1	Require confirmed membership for user access checks, not for admin views (#7763 )	2026-09-23 23:22:43 +02:00
Abhi ShandilyaandDaniel García	d2660324e6	Fix revoked org members retaining access to org ciphers (#7554 ) The cipher access restriction queries (direct collection access, group collection access, and full access via groups) never checked the organization membership status. Since users_collections and groups_users rows are kept when a membership is revoked, revoked (and not yet confirmed) members kept read, write, delete, attachment and collection-move access to org ciphers via the direct-by-UUID endpoints. Require a confirmed membership in the cipher's organization in all three queries, matching the behavior of the sync queries. Co-authored-by: Daniel García <dani-garcia@users.noreply.github.com>	2026-09-23 19:44:05 +02:00
Stefan Melmuk	cc67d644f6	set user_created bool for each separate invitation (#7753 )	2026-09-18 20:35:11 +02:00
Berk D. Demir	3347698712	Add `pm-34171-card-scanner` feature flag (#7477 ) Introduced in 2026.4.1 Mobile releases (Android and iOS), enables use of device camera to autofill a card type item. N.B. This feature relies on Google ML Kit. F-Droid policy disallows Google ML Kit. Because of this, F-Droid builds do not ship with card scanner feature. (See https://github.com/bitwarden/android/pull/6890)	2026-09-18 20:34:41 +02:00
Mathijs van Veluw	a24683636a	Update Crates, GHA and JS (#7751 ) Signed-off-by: BlackDex <black.dex@gmail.com>	2026-09-18 18:44:50 +02:00
Berk D. Demir	64c56411f6	Add `pm-32009-new-item-types` feature flag (#7478 ) Introduced in 2026.4.0 for all clients, enables new item types bank account, driver's license, and passport.	2026-09-18 16:53:27 +02:00
Tom	c3f5477525	Add accepted organization data to sync response (#7666 )	2026-09-18 16:53:17 +02:00
TimshelandTimshel	9c8aa2359f	User key id (#7693 ) Co-authored-by: Timshel <timshel@users.noreply.github.com>	2026-09-18 16:53:06 +02:00
Tom	8719f86fcf	Add basic auth response client feature flag (#7745 )	2026-09-18 16:52:57 +02:00
Tom	fddc8e71be	Support the vault banner policy (#7748 )	2026-09-18 16:52:49 +02:00