[GH-ISSUE #4430] Organization invites fail based on keywords such as 'lock' in the email. #1884

New issue

Closed

opened 2026-03-03 02:13:04 +03:00 by kerem · 1 comment

kerem commented

2026-03-03 02:13:04 +03:00

Owner

Originally created by @gigaion on GitHub (Mar 16, 2024).
Original GitHub issue: https://github.com/dani-garcia/vaultwarden/issues/4430

Subject of the issue

Organization invites fail based on keywords such as 'lock' in the email.

Deployment environment

vaultwarden version:
- Vaultwarden version: 1.30.5

Install method:
- Tested on both latest docker running on either Ubuntu or Debian. Also tested on two separate unrelated installations of vaultwarden.
Clients used:
- Web vault (Join Organization Now) link
Reverse proxy and version
- Tested on both Nginx Proxy Manager (NPM) and Cloudflare Tunnels to verify it wasn't the reverse proxy causing the issue.
MySQL/MariaDB or PostgreSQL version:
- PostgreSQL: Docker Image postgres:14.9
Other relevant details:
- I've discovered a temporary work around to the issue. To get around the problem and have the user join do the following:

Invite user to Organization like usual
Have them create account and use link like normal.
After they login and fail to join organization, have them stay on the logged in tab.
While still logged in, copy the invite link and paste it into the Google Chrome browser URL bar and hit enter.
The page will reload but remain logged in, and the link will work successfully on joining the organization.

I am unsure if this is a bug related specifically to Vaultwarden or the Web Vault code by Bitwarden. Any help by people with resources to test this on Bitwarden official clients would be beneficial in this troubleshooting.

Steps to reproduce

Install Vaultwarden like usual
Create an organization
Invite a user that contains a keyword such as 'lock' in it. In my example i did a username like testlock@input-your-domain-here.com
When they go to register using the link, they will be unable to join the organization even after doing the registration.
Out of 100+ people invited, there is a possibility this affects more then just the keyword 'lock', and I am actively going to start troubleshooting with another user to see if another blocked keyword exists.

Expected behaviour

User should be able to join organization like any other user.

Actual behaviour

User organization invite link does nothing for joining organization, unless you do the workaround method.

Originally created by @gigaion on GitHub (Mar 16, 2024). Original GitHub issue: https://github.com/dani-garcia/vaultwarden/issues/4430 ### Subject of the issue Organization invites fail based on keywords such as 'lock' in the email. ### Deployment environment * vaultwarden version: - Vaultwarden version: 1.30.5  * Install method: - Tested on both latest docker running on either Ubuntu or Debian. Also tested on two separate unrelated installations of vaultwarden. * Clients used:  - Web vault (Join Organization Now) link * Reverse proxy and version - Tested on both Nginx Proxy Manager (NPM) and Cloudflare Tunnels to verify it wasn't the reverse proxy causing the issue. * MySQL/MariaDB or PostgreSQL version:  - PostgreSQL: Docker Image postgres:14.9 * Other relevant details: - I've discovered a temporary work around to the issue. To get around the problem and have the user join do the following: 1. Invite user to Organization like usual 2. Have them create account and use link like normal. 3. After they login and fail to join organization, have them stay on the logged in tab. 4. While still logged in, copy the invite link and paste it into the Google Chrome browser URL bar and hit enter. 5. The page will reload but remain logged in, and the link will work successfully on joining the organization. I am unsure if this is a bug related specifically to Vaultwarden or the Web Vault code by Bitwarden. Any help by people with resources to test this on Bitwarden official clients would be beneficial in this troubleshooting. ### Steps to reproduce - Install Vaultwarden like usual - Create an organization - Invite a user that contains a keyword such as 'lock' in it. In my example i did a username like testlock@input-your-domain-here.com - When they go to register using the link, they will be unable to join the organization even after doing the registration. - Out of 100+ people invited, there is a possibility this affects more then just the keyword 'lock', and I am actively going to start troubleshooting with another user to see if another blocked keyword exists. ### Expected behaviour - User should be able to join organization like any other user. ### Actual behaviour - User organization invite link does nothing for joining organization, unless you do the workaround method.

kerem closed this issue

2026-03-03 02:13:04 +03:00

kerem commented

2026-03-03 02:13:05 +03:00

Author

Owner

@stefan0xC commented on GitHub (Mar 17, 2024):

I can't reproduce this (using Firefox). If I invite a user with a "lock" in the email address, open a new tab and open the join link, create an account and login using this join link, the organization invitation is accepted immediately.

To reproduce this I have to create an account and login without using the join link and then open the join link in the same tab. Then after selecting login and signing in again, nothing happens. Only when I then paste the join link again (in the same tab!) the invitation is accepted.

As far as I've looked into it this is an issue with the web vault that according to this comment requires users to be in a logged out state to accept the organization. (And this happens regardless of a specific keyword in the user's email.)

@stefan0xC commented on GitHub (Mar 17, 2024): I can't reproduce this (using Firefox). If I invite a user with a "lock" in the email address, open a new tab and open the join link, create an account and login using this join link, the organization invitation is accepted immediately. To reproduce this I have to create an account and login without using the join link and then open the join link in the same tab. Then after selecting login and signing in again, nothing happens. Only when I then paste the join link again (in the same tab!) the invitation is accepted. As far as I've looked into it this is an issue with the web vault that [according to this comment requires users to be in a logged out state to accept the organization](https://github.com/bitwarden/clients/blob/web-v2024.2.2/apps/web/src/app/auth/accept-organization.component.ts#L61). (And this happens regardless of a specific keyword in the user's email.)