Password not showing after refresh

[Miaourt]

Hi everyone,

I installed Vaultwarden using Docker a few weeks back and everything works fine for the 2 admin users working on it.

Now I wish to deploy the app to the rest of my coworkers. So I created an organization, and tried to invite 2 more users in it. Everytime these 2 users refresh the web page, each one of their passwords (shared or not) disappears:

Before refresh :

After refresh :

When the users logout and re-login, the passwords are shown again.
The issue appears on Chrome and Firefox, I didn’t try on other browsers.
Sometimes, the passwords don’t disappear after a refresh (especially on Firefox), but they do most of the time.
The 2 admin users (that are in the same organization) don’t have the issue, so I tried giving one of the the new users the exact same permissions as one of the admin → The passwords still disappear after refresh.
When I remove the users of the organization, they don’t have the problem anymore, but when I reinvite them, the issue comes back.
No error in the docker logs or in the Chrome dev tools.
No issue on the web extension or the Windows app.
When I look in the dev tools when refreshing, the passwords seems to be sent by the server :

Does anyone have an idea on where the issue might come from?

Thanks in advance.

[cksapp]

Refresh of the web-vault should lock the vault, and require unlock with the master password.

I imagine the items being hidden is likely due to the vault actually going into this locked state, but strange that the GUI is not showing correctly.

[Miaourt]

Hi,

Thanks for your answer.

The vault is indeed locked after the refresh, but the passwords are hidden after the vault is unlocked with master password.

[Miaourt]

Hi everybody,

I found a “solution” :

The problem seems to appear when the user have not enough password to trigger this loading screen after unlocking the vault :

I asked one of the user that had the issue to import a large number of passwords and the issue was resolved for him.

I then tried to delete all of the passwords of one of the administrators that had no issue (me), and the problem appeared on this account.

I don’t know if this happens only in my environnement, but if someone could try to add a user with a small personal vault to an organisation, and then refresh while in the vault of that user to see if that’s a bug or something in my setup, that would be nice.