[GH-ISSUE #1025] Change Master Password with "encryption key rotation" fails (but password is changed) #723

New issue

Closed

opened 2026-03-03 02:02:34 +03:00 by kerem · 1 comment

kerem commented

2026-03-03 02:02:34 +03:00

Owner

Originally created by @BlackDex on GitHub (Jun 7, 2020).
Original GitHub issue: https://github.com/dani-garcia/vaultwarden/issues/1025

Subject of the issue

When changing the master password and checking the "Also rotate my account's encryption key" causes an error 422 Unprocessable Entity.

Your environment

Bitwarden_rs version: 1.15.0-db535118
Install method: Build from source
Clients used: web-vault
Reverse proxy and version: n/a
Version of mysql/postgresql: n/a
Other relevant information:

Steps to reproduce

Go to your account settings in the web-vault
Scroll down to "Change Master Password"
Fill-in your current password and twice a new password.
Check "Also rotate my account's encryption key"
Click on the "Change Master Password" button.
See the error.
Returning to the vault looks like all is gone.
Logout and back in, entries are back again.

Expected behaviour

No errors

Actual behaviour

Error occurred and need to manually logout and back in again to see passwords.

Relevant logs

[2020-06-07 14:34:29][request][INFO] GET /api/sync?excludeDomains=true
[2020-06-07 14:34:29][response][INFO] GET /api/sync?<data..> (sync) => 200 OK
[2020-06-07 14:34:29][request][INFO] POST /api/accounts/password
[2020-06-07 14:34:30][response][INFO] POST /api/accounts/password (post_password) => 200 OK
[2020-06-07 14:34:35][request][INFO] POST /api/accounts/key
[2020-06-07 14:34:35][response][INFO] POST /api/accounts/key (post_rotatekey) => 422 Unprocessable Entity

Originally created by @BlackDex on GitHub (Jun 7, 2020). Original GitHub issue: https://github.com/dani-garcia/vaultwarden/issues/1025 ### Subject of the issue When changing the master password and checking the "Also rotate my account's encryption key" causes an error `422 Unprocessable Entity`. ### Your environment * Bitwarden_rs version: 1.15.0-db535118 * Install method: Build from source * Clients used: web-vault * Reverse proxy and version: n/a * Version of mysql/postgresql: n/a * Other relevant information: ### Steps to reproduce 1. Go to your account settings in the web-vault 2. Scroll down to "Change Master Password" 3. Fill-in your current password and twice a new password. 4. Check "Also rotate my account's encryption key" 5. Click on the "Change Master Password" button. 6. See the error. 7. Returning to the vault looks like all is gone. 8. Logout and back in, entries are back again. ### Expected behaviour No errors ### Actual behaviour Error occurred and need to manually logout and back in again to see passwords. ### Relevant logs ``` [2020-06-07 14:34:29][request][INFO] GET /api/sync?excludeDomains=true [2020-06-07 14:34:29][response][INFO] GET /api/sync?<data..> (sync) => 200 OK [2020-06-07 14:34:29][request][INFO] POST /api/accounts/password [2020-06-07 14:34:30][response][INFO] POST /api/accounts/password (post_password) => 200 OK [2020-06-07 14:34:35][request][INFO] POST /api/accounts/key [2020-06-07 14:34:35][response][INFO] POST /api/accounts/key (post_rotatekey) => 422 Unprocessable Entity ```

kerem closed this issue

2026-03-03 02:02:34 +03:00

kerem commented

2026-03-03 02:02:35 +03:00

Author

Owner

@BlackDex commented on GitHub (Jun 7, 2020):

While fixing issue #1022 i encountered this problem.
It appears to happen after trying to clone an item with an attachment within an organization.
This created bogus empty password items which in turn caused issues during the key rotation.

The solution is to first remove these items from the vault and the trash folder before chaining the master password with key-rotation.

@BlackDex commented on GitHub (Jun 7, 2020): While fixing issue #1022 i encountered this problem. It appears to happen after trying to clone an item with an attachment within an organization. This created bogus empty password items which in turn caused issues during the key rotation. The solution is to first remove these items from the vault and the trash folder before chaining the master password with key-rotation.