Cannot login after downgrade 2025.8.0 to 2025.7.0

[wookash]

Prerequisites

• I have searched the existing Closed AND Open Issues AND Discussions
• I have searched and read the documentation

Vaultwarden Support String

Your environment (Generated via diagnostics page)

• Vaultwarden version: v1.34.3-a2ad1dc7
• Web-vault version: v2025.8.0
• OS/Arch: linux/aarch64
• Running within a container: true (Base: Debian)
• Database type: SQLite
• Database version: 3.50.2
• Uses config.json: true
• Uses a reverse proxy: false
• Internet access: true
• Internet access via a proxy: false
• DNS Check: true
• TZ environment:
• Browser/Server Time Check: true
• Server/NTP Time Check: true
• Domain Configuration Check: false
• HTTPS Check: true
• Websocket Check: true
• HTTP Response Checks: true

Config & Details (Generated via diagnostics page)

Show Config & Details

Environment settings which are overridden: DOMAIN, SIGNUPS_ALLOWED, INVITATIONS_ALLOWED, SSO_ENABLED, SSO_ONLY, SSO_CLIENT_ID, SSO_CLIENT_SECRET, SSO_AUTHORITY, SSO_DEBUG_TOKENS, SMTP_HOST, SMTP_SECURITY, SMTP_PORT, SMTP_FROM, SMTP_FROM_NAME, SMTP_USERNAME, SMTP_PASSWORD, SMTP_AUTH_MECHANISM, HELO_NAME

Config:

{
  "_duo_akey": null,
  "_enable_duo": false,
  "_enable_email_2fa": true,
  "_enable_smtp": true,
  "_enable_yubico": true,
  "_icon_service_csp": "",
  "_icon_service_url": "",
  "_ip_header_enabled": true,
  "_max_note_size": 10000,
  "_smtp_img_src": "***:",
  "admin_ratelimit_max_burst": 3,
  "admin_ratelimit_seconds": 300,
  "admin_session_lifetime": 20,
  "admin_token": null,
  "allowed_connect_src": "",
  "allowed_iframe_ancestors": "",
  "attachments_folder": "data/attachments",
  "auth_request_purge_schedule": "30 * * * * *",
  "authenticator_disable_time_drift": false,
  "data_folder": "data",
  "database_conn_init": "",
  "database_idle_timeout": 600,
  "database_max_conns": 10,
  "database_min_conns": 2,
  "database_timeout": 30,
  "database_url": "***************",
  "db_connection_retries": 15,
  "disable_2fa_remember": false,
  "disable_admin_token": true,
  "disable_icon_download": false,
  "domain": "*****://***********************",
  "domain_origin": "*****://***********************",
  "domain_path": "",
  "domain_set": true,
  "duo_context_purge_schedule": "30 * * * * *",
  "duo_host": null,
  "duo_ikey": null,
  "duo_skey": null,
  "duo_use_iframe": false,
  "email_2fa_auto_fallback": false,
  "email_2fa_enforce_on_verified_invite": false,
  "email_attempts_limit": 3,
  "email_change_allowed": true,
  "email_expiration_time": 600,
  "email_token_size": 6,
  "emergency_access_allowed": true,
  "emergency_notification_reminder_schedule": "0 3 * * * *",
  "emergency_request_timeout_schedule": "0 7 * * * *",
  "enable_db_wal": true,
  "enable_websocket": true,
  "enforce_single_org_with_reset_pw_policy": false,
  "event_cleanup_schedule": "0 10 0 * * *",
  "events_days_retain": null,
  "experimental_client_feature_flags": "",
  "extended_logging": true,
  "helo_name": "***********************",
  "hibp_api_key": null,
  "http_request_block_non_global_ips": true,
  "http_request_block_regex": null,
  "icon_blacklist_non_global_ips": true,
  "icon_blacklist_regex": null,
  "icon_cache_folder": "data/icon_cache",
  "icon_cache_negttl": 259200,
  "icon_cache_ttl": 2592000,
  "icon_download_timeout": 10,
  "icon_redirect_code": 302,
  "icon_service": "internal",
  "incomplete_2fa_schedule": "30 * * * * *",
  "incomplete_2fa_time_limit": 3,
  "increase_note_size_limit": false,
  "invitation_expiration_hours": 120,
  "invitation_org_name": "",
  "invitations_allowed": false,
  "ip_header": "X-Real-IP",
  "job_poll_interval_ms": 30000,
  "log_file": null,
  "log_level": "debug",
  "log_timestamp_format": "%Y-%m-%d %H:%M:%S.%3f",
  "login_ratelimit_max_burst": 10,
  "login_ratelimit_seconds": 60,
  "org_attachment_limit": null,
  "org_creation_users": "",
  "org_events_enabled": false,
  "org_groups_enabled": false,
  "password_hints_allowed": true,
  "password_iterations": 100000,
  "purge_incomplete_sso_nonce": "0 20 0 * * *",
  "push_enabled": false,
  "push_identity_uri": "https://identity.bitwarden.com",
  "push_installation_id": "***",
  "push_installation_key": "***",
  "push_relay_uri": "https://push.bitwarden.com",
  "reload_templates": false,
  "require_device_email": false,
  "rsa_key_filename": "data/rsa_key",
  "send_purge_schedule": "0 5 * * * *",
  "sendmail_command": null,
  "sends_allowed": true,
  "sends_folder": "data/sends",
  "show_password_hint": false,
  "signups_allowed": false,
  "signups_domains_whitelist": "",
  "signups_verify": false,
  "signups_verify_resend_limit": 6,
  "signups_verify_resend_time": 3600,
  "smtp_accept_invalid_certs": false,
  "smtp_accept_invalid_hostnames": false,
  "smtp_auth_mechanism": "Login",
  "smtp_debug": false,
  "smtp_embed_images": true,
  "smtp_explicit_tls": null,
  "smtp_from": "******************",
  "smtp_from_name": "",
  "smtp_host": "*************************",
  "smtp_password": "***",
  "smtp_port": 587,
  "smtp_security": "starttls",
  "smtp_ssl": true,
  "smtp_timeout": 15,
  "smtp_username": "*************************",
  "sso_allow_unknown_email_verification": false,
  "sso_audience_trusted": null,
  "sso_auth_only_not_session": false,
  "sso_authority": "*****://******************",
  "sso_authorize_extra_params": "",
  "sso_callback_path": "*****://****************************************************",
  "sso_client_cache_expiration": 0,
  "sso_client_id": "************************************",
  "sso_client_secret": "***",
  "sso_debug_tokens": false,
  "sso_enabled": true,
  "sso_master_password_policy": null,
  "sso_only": false,
  "sso_pkce": true,
  "sso_scopes": "email profile",
  "sso_signups_match_email": true,
  "templates_folder": "data/templates",
  "tmp_folder": "data/tmp",
  "trash_auto_delete_days": null,
  "trash_purge_schedule": "0 5 0 * * *",
  "use_sendmail": false,
  "use_syslog": false,
  "user_attachment_limit": null,
  "user_send_limit": null,
  "web_vault_enabled": true,
  "web_vault_folder": "web-vault/",
  "yubico_client_id": null,
  "yubico_secret_key": null,
  "yubico_server": null
}

Vaultwarden Build Version

1.34.3

Deployment method

Official Container Image

Custom deployment method

hello,

I wanted to test the new sso feature so I switched to from latest to testing image and now when I downgraded back to 1.34.3 stable I cannot login, I got an error: "An error has occurred. Serde", see the container logs below:

and i get this email:

Someone attempted to log into your account with the correct master password, but did not provide the correct token or action required to complete the two-step login process within 3 minutes of the initial login attempt.

I don't get any prompt for 2FA (I have TOTP and passkey)

Reverse Proxy

nginx

Host/Server Operating System

Linux

Operating System Version

debian 12

Clients

iOS, Browser Extension, Web Vault

Client Version

No response

Steps To Reproduce

downgrade from 1.34.3 testing to 1.34.4 stable image
attempt log in

Expected Result

successful prompt for 2FA and login

Actual Result

error "An error has occurred. Serde"

Logs

`[2025-09-12 17:35:00.689][request][INFO] GET /

[2025-09-12 17:35:00.692][response][INFO] (web_index) GET / => 200 OK

[2025-09-12 17:35:01.031][request][INFO] GET /

[2025-09-12 17:35:01.032][response][INFO] (web_index) GET / => 200 OK

[2025-09-12 17:35:01.248][request][INFO] GET /

[2025-09-12 17:35:01.248][response][INFO] (web_index) GET / => 200 OK

[2025-09-12 17:35:01.466][request][INFO] GET /

[2025-09-12 17:35:01.466][response][INFO] (web_index) GET / => 200 OK

[2025-09-12 17:35:01.619][request][INFO] GET /

[2025-09-12 17:35:01.620][response][INFO] (web_index) GET / => 200 OK

[2025-09-12 17:35:05.638][request][INFO] GET /api/devices/knowndevice

[2025-09-12 17:35:05.649][response][INFO] (get_known_device) GET /api/devices/knowndevice => 200 OK

[2025-09-12 17:35:10.248][request][INFO] POST /identity/accounts/prelogin

[2025-09-12 17:35:10.250][response][INFO] (prelogin) POST /identity/accounts/prelogin => 200 OK

[2025-09-12 17:35:10.350][request][INFO] POST /identity/connect/token

[2025-09-12 17:35:10.505][error][ERROR] Serde.

[CAUSE] Error("missing field type_", line: 1, column: 623)

[2025-09-12 17:35:10.505][response][INFO] (login) POST /identity/connect/token => 400 Bad Request`

Screenshots or Videos

No response

Additional Context

No response

[BlackDex]

That is known to happen, and no way we can solve this code-wise.
Either remove all 2FA's for all users, or restore a backup of that table to one before using the testing tagged container.

[wookash]

That is known to happen, and no way we can solve this code-wise. Either remove all 2FA's for all users, or restore a backup of that table to one before using the testing tagged container.

Thank you for quick reply. So are you saying that support for both 2FA and SSO is not possible at all or that it is not going to be implemented in the testing image?

I did restore from backup, perhaps it's worth adding this info to the top of the page https://github.com/dani-garcia/vaultwarden/wiki/Enabling-SSO-support-using-OpenId-Connect (unless I've missed it anywhere else in that link?)

[matt95allen]

I had the same issue. I second maybe adding a warning about downgrading from testing to latest, and if there is a warning already maybe make it more obvious for goobers like me.