bitwarden/server · error · BadRequestException

Cannot edit item. Update to the latest version of Bitwarden

Error message

Cannot edit item. Update to the latest version of Bitwarden and try again.

What it means

Thrown by ValidateClientVersionForFido2CredentialSupport when all of these are true: the cipher is a Login type, the data blob is not encrypted (server can deserialize it), the deserialized login data contains Fido2Credentials, and _currentContext.ClientVersion is below _fido2KeyCipherMinimumVersion (which is Version '2023.10.0'). This prevents older clients from corrupting or misinterpreting passkey/FIDO2 credential data they cannot handle.

Source

Thrown at src/Api/Vault/Controllers/CiphersController.cs:1659

        });
    }

    private void ValidateAttachment()
    {
        if (!Request?.ContentType.Contains("multipart/") ?? true)
        {
            throw new BadRequestException("Invalid content.");
        }
    }

    private void ValidateClientVersionForFido2CredentialSupport(Cipher cipher)
    {
        if (cipher.Type == Core.Vault.Enums.CipherType.Login && !cipher.IsDataBlobEncrypted())
        {
            var loginData = JsonSerializer.Deserialize<CipherLoginData>(cipher.Data);
            if (loginData?.Fido2Credentials != null && _currentContext.ClientVersion < _fido2KeyCipherMinimumVersion)
            {
                throw new BadRequestException("Cannot edit item. Update to the latest version of Bitwarden and try again.");
            }
        }
    }

    private async Task<CipherOrganizationDetails> GetByIdAsyncAdmin(Guid cipherId)
    {
        return await _cipherRepository.GetOrganizationDetailsByIdAsync(cipherId);
    }

    private async Task<CipherDetails> GetByIdAsync(Guid cipherId, Guid userId)
    {
        return await _cipherRepository.GetByIdAsync(cipherId, userId);
    }

    private DateTime? GetLastKnownRevisionDateFromForm()
    {
        DateTime? lastKnownRevisionDate = null;
        if (Request.Form.TryGetValue("lastKnownRevisionDate", out var dateValue))

View on GitHub (pinned to e93b962371)

Solutions

1. Update the Bitwarden client to the latest version (at minimum 2023.10.0)
2. Verify the Bitwarden-Client-Version header is sent with every request from the client
3. If behind a proxy or API gateway, ensure client headers are forwarded unchanged
4. For CLI users, upgrade bw to the latest release

// Check client version before editing a cipher with FIDO2 credentials
var minVersion = new Version("2023.10.0");
if (currentClientVersion < minVersion && cipherHasFido2Credentials)
{
    throw new InvalidOperationException(
        $"Client version {currentClientVersion} is too old. Minimum required: {minVersion}. " +
        "Update to the latest version of Bitwarden.");
}
// Safe to proceed

// Type guard / version check helper
static bool ClientSupportsFido2(Version clientVersion)
{
    return clientVersion >= new Version("2023.10.0");
}

When it happens

Trigger: An outdated Bitwarden client (extension, desktop, mobile, web, or CLI) attempts to edit a cipher that contains FIDO2/passkey credentials; the Bitwarden-Client-Version header is missing or reports a version below 2023.10.0; a proxy strips client headers.

Common situations: User has an outdated browser extension or mobile app that predates passkey support; automated tooling using an old CLI version; a reverse proxy strips the Bitwarden-Client-Version header; the web vault served a stale cached version.

Related errors

• Unable to complete WebAuthn registration.
• Unable to complete WebAuthn registration.
• The token associated with your request is expired. A valid t
• Passkeys cannot be created for your account. SSO login is re
• The token associated with your request is invalid or has exp

AI-assisted analysis of bitwarden/server@e93b962371 (2026-08-13). Data as JSON: /api/errors/13ac4341eb77f614. Report an issue: GitHub.