Bitwarden Send access limitation allows too many access attempts. #981

New issue

Closed

opened 2026-02-20 08:06:36 -05:00 by deekerman · 1 comment

deekerman commented

2026-02-20 08:06:36 -05:00

Owner

Originally created by @drownthewitch on GitHub (Mar 15, 2021).

Subject of the issue

The current testing version of the Bitwarden_rs server seems to allow N+1 access attempts to a shared Bitwarden Send resource, when N are configured.

For example, when 1 allowed access attempt is configured, 2 visits are allowed before the published Send resource is disabled, when 2 are configured, 3 are allowed, etc.

Deployment environment

Your environment (Generated via diagnostics page)

Bitwarden_rs version: v1.19.0-7436b454
Web-vault version: v2.19.0
Running within Docker: true
Internet access: true
Uses a proxy: false
DNS Check: true
Time Check: true
Domain Configuration Check: true
HTTPS Check: true
Database type: SQLite
Clients used:
Reverse proxy and version:
Other relevant information:

Config (Generated via diagnostics page)

{
  "_duo_akey": null,
  "_enable_duo": false,
  "_enable_email_2fa": false,
  "_enable_smtp": false,
  "_enable_yubico": true,
  "_ip_header_enabled": true,
  "admin_token": "***",
  "allowed_iframe_ancestors": "",
  "attachments_folder": "data/attachments",
  "authenticator_disable_time_drift": false,
  "data_folder": "data",
  "database_max_conns": 10,
  "database_url": "****/**.*******",
  "db_connection_retries": 15,
  "disable_2fa_remember": false,
  "disable_admin_token": false,
  "disable_icon_download": false,
  "domain": "*****://*****.***********.***/",
  "domain_origin": "*****://*****.***********.***",
  "domain_path": "",
  "domain_set": true,
  "duo_host": null,
  "duo_ikey": null,
  "duo_skey": null,
  "email_attempts_limit": 3,
  "email_expiration_time": 600,
  "email_token_size": 6,
  "enable_db_wal": true,
  "extended_logging": true,
  "helo_name": null,
  "hibp_api_key": null,
  "icon_blacklist_non_global_ips": true,
  "icon_blacklist_regex": null,
  "icon_cache_folder": "data/icon_cache",
  "icon_cache_negttl": 259200,
  "icon_cache_ttl": 2592000,
  "icon_download_timeout": 10,
  "invitation_org_name": "*****",
  "invitations_allowed": false,
  "ip_header": "X-Real-IP",
  "log_file": null,
  "log_level": "Info",
  "log_timestamp_format": "%Y-%m-%d %H:%M:%S.%3f",
  "org_attachment_limit": null,
  "org_creation_users": "",
  "password_iterations": 100000,
  "reload_templates": false,
  "require_device_email": false,
  "rsa_key_filename": "data/rsa_key",
  "sends_folder": "data/sends",
  "show_password_hint": true,
  "signups_allowed": false,
  "signups_domains_whitelist": "",
  "signups_verify": false,
  "signups_verify_resend_limit": 6,
  "signups_verify_resend_time": 3600,
  "smtp_accept_invalid_certs": false,
  "smtp_accept_invalid_hostnames": false,
  "smtp_auth_mechanism": null,
  "smtp_debug": false,
  "smtp_explicit_tls": false,
  "smtp_from": "",
  "smtp_from_name": "Bitwarden_RS",
  "smtp_host": null,
  "smtp_password": null,
  "smtp_port": 587,
  "smtp_ssl": true,
  "smtp_timeout": 15,
  "smtp_username": null,
  "templates_folder": "data/templates",
  "use_syslog": false,
  "user_attachment_limit": null,
  "web_vault_enabled": true,
  "web_vault_folder": "web-vault/",
  "websocket_address": "0.0.0.0",
  "websocket_enabled": false,
  "websocket_port": 3012,
  "yubico_client_id": null,
  "yubico_secret_key": null,
  "yubico_server": null
}

bitwarden_rs version: 1.19.0-7436b454

Install method: Docker image
Clients used: Firefox plugin, Web vault
Reverse proxy and version:
MySQL/MariaDB or PostgreSQL version:
Other relevant details:

Steps to reproduce

Create a Bitwarden Send text share and set it for 2 allowed access attempts.
Access the link up to 3 times and notice all attempts succeed.
Notice a 4th access attempt does fail.

Expected behaviour

The link should expire after the amount of access attempts configured.

Actual behaviour

The link only expires after N+1 access attempts have been made.

Troubleshooting data

Originally created by @drownthewitch on GitHub (Mar 15, 2021).   ### Subject of the issue  The current testing version of the Bitwarden_rs server seems to allow N+1 access attempts to a shared Bitwarden Send resource, when N are configured. For example, when 1 allowed access attempt is configured, 2 visits are allowed before the published Send resource is disabled, when 2 are configured, 3 are allowed, etc. ### Deployment environment  ### Your environment (Generated via diagnostics page) * Bitwarden_rs version: v1.19.0-7436b454 * Web-vault version: v2.19.0 * Running within Docker: true * Internet access: true * Uses a proxy: false * DNS Check: true * Time Check: true * Domain Configuration Check: true * HTTPS Check: true * Database type: SQLite * Clients used: * Reverse proxy and version: * Other relevant information: ### Config (Generated via diagnostics page) ```json { "_duo_akey": null, "_enable_duo": false, "_enable_email_2fa": false, "_enable_smtp": false, "_enable_yubico": true, "_ip_header_enabled": true, "admin_token": "***", "allowed_iframe_ancestors": "", "attachments_folder": "data/attachments", "authenticator_disable_time_drift": false, "data_folder": "data", "database_max_conns": 10, "database_url": "****/**.*******", "db_connection_retries": 15, "disable_2fa_remember": false, "disable_admin_token": false, "disable_icon_download": false, "domain": "*****://*****.***********.***/", "domain_origin": "*****://*****.***********.***", "domain_path": "", "domain_set": true, "duo_host": null, "duo_ikey": null, "duo_skey": null, "email_attempts_limit": 3, "email_expiration_time": 600, "email_token_size": 6, "enable_db_wal": true, "extended_logging": true, "helo_name": null, "hibp_api_key": null, "icon_blacklist_non_global_ips": true, "icon_blacklist_regex": null, "icon_cache_folder": "data/icon_cache", "icon_cache_negttl": 259200, "icon_cache_ttl": 2592000, "icon_download_timeout": 10, "invitation_org_name": "*****", "invitations_allowed": false, "ip_header": "X-Real-IP", "log_file": null, "log_level": "Info", "log_timestamp_format": "%Y-%m-%d %H:%M:%S.%3f", "org_attachment_limit": null, "org_creation_users": "", "password_iterations": 100000, "reload_templates": false, "require_device_email": false, "rsa_key_filename": "data/rsa_key", "sends_folder": "data/sends", "show_password_hint": true, "signups_allowed": false, "signups_domains_whitelist": "", "signups_verify": false, "signups_verify_resend_limit": 6, "signups_verify_resend_time": 3600, "smtp_accept_invalid_certs": false, "smtp_accept_invalid_hostnames": false, "smtp_auth_mechanism": null, "smtp_debug": false, "smtp_explicit_tls": false, "smtp_from": "", "smtp_from_name": "Bitwarden_RS", "smtp_host": null, "smtp_password": null, "smtp_port": 587, "smtp_ssl": true, "smtp_timeout": 15, "smtp_username": null, "templates_folder": "data/templates", "use_syslog": false, "user_attachment_limit": null, "web_vault_enabled": true, "web_vault_folder": "web-vault/", "websocket_address": "0.0.0.0", "websocket_enabled": false, "websocket_port": 3012, "yubico_client_id": null, "yubico_secret_key": null, "yubico_server": null } ```    * bitwarden_rs version: 1.19.0-7436b454  * Install method: Docker image * Clients used: Firefox plugin, Web vault * Reverse proxy and version:  * MySQL/MariaDB or PostgreSQL version:  * Other relevant details: ### Steps to reproduce  1. Create a Bitwarden Send text share and set it for 2 allowed access attempts. 2. Access the link up to 3 times and notice all attempts succeed. 3. Notice a 4th access attempt does fail. ### Expected behaviour  - The link should expire after the amount of access attempts configured. ### Actual behaviour  - The link only expires after N+1 access attempts have been made. ### Troubleshooting data

deekerman

2026-02-20 08:06:36 -05:00

closed this issue
added the
good first issue

bug
labels

deekerman commented

2026-02-20 08:06:37 -05:00

Author

Owner

@BlackDex commented on GitHub (Mar 15, 2021):

This has been fixed already: https://github.com/dani-garcia/bitwarden_rs/pull/1487

Thanks for reporting with all the details.

@BlackDex commented on GitHub (Mar 15, 2021): This has been fixed already: https://github.com/dani-garcia/bitwarden_rs/pull/1487 Thanks for reporting with all the details.

deekerman referenced this issue

2026-02-20 08:07:21 -05:00

Organization — Two-step login enforcement doesn't work #1078