[GH-ISSUE #1213] Reports old "Exposed passwords" #858

New issue

Closed

opened 2026-03-03 02:04:04 +03:00 by kerem · 2 comments

kerem commented

2026-03-03 02:04:04 +03:00

Owner

Originally created by @mcfrojd on GitHub (Nov 1, 2020).
Original GitHub issue: https://github.com/dani-garcia/vaultwarden/issues/1213

Subject of the issue

The report of exposed passwords still shows me passwords that have been changed.
Is the old passwords stored i db for the "updated password counter"?
And if so, is the report generator including these passwords when generating the report?
Or am i missing some "purge" function that "cleans" the database from old changed passwords?

Your environment

Bitwarden_rs version:
Server Latest 1.17.0
Web Latest 2.16.1

Install method: Docker-compose
Clients used: Android app, chrome app
Reverse proxy and version: Nginx Reverse Proxy Manager 2.3.1
Version of mysql/postgresql:
Other relevant information:

Steps to reproduce

When in my web vault, running the tools/report exposed passwords, the report shows me password entries with old (exposed) passwords.
When i click them in the report it shows the old password, and if i click the entry in the vault i see the new changed password (changed 2 month ago)

Expected behaviour

The report should not generate warnings on passwords that have been changed in the vault.

Actual behaviour

Im guessing the old passwords are still stored somewhere and the report generator can still find these old passwords and keeps warning me about them.
I cant see the old password anywhere in the web vault, but if i use search and type in my old exposed password i get a list of entries that have had that password before i changed them, but i cant see that old password when i open the items from the list

Relevant logs

Originally created by @mcfrojd on GitHub (Nov 1, 2020). Original GitHub issue: https://github.com/dani-garcia/vaultwarden/issues/1213   ### Subject of the issue The report of exposed passwords still shows me passwords that have been changed. Is the old passwords stored i db for the "updated password counter"? And if so, is the report generator including these passwords when generating the report? Or am i missing some "purge" function that "cleans" the database from old changed passwords? ### Your environment   * Bitwarden_rs version: Server Latest 1.17.0 Web Latest 2.16.1  * Install method: Docker-compose * Clients used: Android app, chrome app * Reverse proxy and version: Nginx Reverse Proxy Manager 2.3.1 * Version of mysql/postgresql:  * Other relevant information: ### Steps to reproduce  When in my web vault, running the tools/report exposed passwords, the report shows me password entries with old (exposed) passwords. When i click them in the report it shows the old password, and if i click the entry in the vault i see the new changed password (changed 2 month ago) ### Expected behaviour  The report should not generate warnings on passwords that have been changed in the vault. ### Actual behaviour  Im guessing the old passwords are still stored somewhere and the report generator can still find these old passwords and keeps warning me about them. I cant see the old password anywhere in the web vault, but if i use search and type in my old exposed password i get a list of entries that have had that password before i changed them, but i cant see that old password when i open the items from the list ### Relevant logs

kerem closed this issue

2026-03-03 02:04:04 +03:00

kerem commented

2026-03-03 02:04:05 +03:00

Author

Owner

@BlackDex commented on GitHub (Nov 2, 2020):

Hello @mcfrojd,

All this is done client-side via the web-vault which we do not maintain.
For items regarding the web-vault behaving not as expected you are better of going to https://github.com/bitwarden/web/

@BlackDex commented on GitHub (Nov 2, 2020): Hello @mcfrojd, All this is done client-side via the web-vault which we do not maintain. For items regarding the web-vault behaving not as expected you are better of going to https://github.com/bitwarden/web/

kerem commented

2026-03-03 02:04:05 +03:00

Author

Owner

@sichkarmg commented on GitHub (Nov 5, 2020):

Mcfrojd Sorry I could not wait long, I have the same problem.
https://github.com/bitwarden/web/issues/690

@sichkarmg commented on GitHub (Nov 5, 2020): Mcfrojd Sorry I could not wait long, I have the same problem. https://github.com/bitwarden/web/issues/690