View all latest updates

2025

• August

2024

2023

As new security advisories are published online for various systems, Keeper Security will post relevant information here.

Bug Fixes

• VAUL-7701: We now support Dropbox and Google Chrome password CSV exports into the vault.

• KDE-1722, 1720, 1723, 1727: Hotkeys now work reliably across Windows, Edge/Chrome, and international layouts, with fixes for focus handling, Ctrl+Shift+P, and repeated single-key triggers.

Security Updates

• KDE-1724: Resolved library "tmp" package related to CVE-2025-54798

Bug Fixes

• KDE-1708: Resolved issue with macOS hot key autofill from KeeperFill for Apps due to changes in the Desktop App version 17.3.1

Security Updates

• KDE-1594: Added protection against "synthetic mouse/key events" from 3rd party applications on Windows devices (reported by Bugcrowd researchers).

Bug Fixes

• KDE-1708: Resolved issue where exiting the app caused a noticeable delay

Security Updates

• KDE-1418: CVE-2023-4863 Heap buffer overflow vulnerability in the WebP Codec. Updated Electron framework.

Security Updates

• VAUL-5868: Upgrade to React 18 library

Bug Fixes

• VAUL-5211: After logout and login, SSO users will no longer be set on the SSO Domain screen.

• KDE-1371: App crash when registering a security key

Improvements

• Set new default PBKDF2 iterations to 1,000,000 rounds

Bug Fixes

• KDE-1313: LastPass automated import hanging on some accounts

• KDE-1319: Safari import hanging on macOS Ventura

Older release note content is still available, but anything older than the last 10 updates is placed here.

Bug Fixes

• KDE-1317: Debian package compatibility issues

• KDE-1318: RPM package compatibility with CentOS7

Bug Fixes

• VAUL-5546: BreachWatch re-scanning records repeatedly

• KDE-1301: TOTP QR code scanning window not working

Bug Fixes

• KDE-1273: Touch ID shows as "enabled" for users after an app reset

• KDS-1277: Custom Record Template showing "Discard Changes?" on save

• VAUL-4849: Showing content security policy error in console on login

• VAUL-5362: EU data center BreachWatch errors for users on a free trial

Improvements

• Added support for Password Manager Pro import

• Added support for generic .xls or .xlsx file import

Bug Fixes

• Emails with a "-" are unable to login

Features

• VAUL-5409: Support for JP and CA regions

• Support for Safari 15 automated password import

Bug Fixes

• REL-3160: Import instructions for Avast are missing

Bug Fixes

• VAUL-4584: CSP error upon loading Web Vault v15.0.12

• KDE-989: JavaScript runtime error upon launching Keeper Desktop on Mac (Big Sur)

Notice of deprecation for legacy versions

Keeper deprecates older versions of application software listed below. This means they’ll no longer be available from our published sources, and the backend will reject any requests coming from those versions.

Keeper Client Applications below 17.0

Keeper client applications with a client version of less than 17.0 are considered deprecated.

This applies to the following applications:

• Keeper Desktop

• Mobile Apps

• Automator

• On-prem SSO Connect

Keeper has released major security improvements with platform version 17. The new architecture introduces the ability for all software components and clients to apply more robust and faster cryptographic algorithms.

Browser Extensions and mobile apps typically auto-update, unless the function has been specifically disabled. If you disabled automatic updates for any of our applications, we encourage you to perform the updates immediately. Likewise if those applications are being deployed as part of a company managed process, please include them in your nearest maintenance window or update cycle.

Important: The following enterprise software components require a manual upgrade which typically involves minor service downtime, similar to updates you performed in the past for the applications. The upgrade process is the same as in the past and typically involves downloading and installing the latest version.

• On-prem SSO Connect

• Enterprise Bridge

If you need assistance with these components, please with our support team to schedule the upgrade.

Keeper Connection Manager on EL7

With CentOS 7 having reached end-of-life in June 2024, and with RHEL 7 having reached end-of-maintenance at the same time, KCM will no longer provide EL7 builds. This means that the previous release (KCM 2.19.3) will be the last release with an EL7 build and KCM 2.20.0 will be the first release without EL7 support.

Users that are maintaining RPM-based installations of KCM but are still using RHEL 7, CentOS 7, or another EL7-derivative should upgrade to EL8 or EL9 when possible so that they can upgrade to KCM 2.20.0. Support EL10 will be coming in a future release.

Keeper Desktop 32-bit binary version

The 32-bit Keeper Desktop client application is considered obsolete.

Per Microsoft, starting with the May 2020 Update (Version 2004), new OEM computers are required to use 64-bit builds. A 32-bit application does not benefit from the Windows app-model security since it does not have access to the TPM/Windows Credential Locker for encrypting the device-key and does not support Windows Hello.

Keeper Gateway below 1.5

The Keeper Gateway service with a client version of less than 1.5 are considered deprecated.

If you have any questions, please .

NIST Link

https://nvd.nist.gov/vuln/detail/CVE-2023-44487

Description

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

Impact to Keeper

Keeper Security's application servers are protected by AWS Shield which defends against DDoS attacks, and Keeper is not vulnerable to this attack. More info is posted on .

If you have any questions, please email us at [email protected].

NIST Link

https://nvd.nist.gov/vuln/detail/CVE-2023-27706

Description

Bitwarden Windows desktop application versions prior to v2023.4.0 store biometric keys in Windows Credential Manager, accessible to other local unprivileged processes.

Impact to Keeper

Keeper is not impacted by this issue. To ensure that we were not impacted by a similar vulnerability, Keeper contracted a 3rd party penetration tester in July 2023 to validate our protection against this type of attack. The report PDF is posted below:

If you have any questions, please email us at [email protected].

Features

• VAUL-6001: Security Key can be set up as the only 2FA method

• VAUL-6097: Support for Security Key and PIN enforcement policies

• VAUL-6129: Users can now control if FIDO2 WebAuthn user verification (PIN) is required

Bug Fixes

• VAUL-6395: KeeperPAM Router/Gateway connection issue in GovCloud environment

NIST Link

Description

The terminal emulator of Apache Guacamole 1.5.5 and older does not properly validate console codes received from servers via text-based protocols like SSH. If a malicious user has access to a text-based connection, a specially-crafted sequence of console codes could allow arbitrary code to be executed with the privileges of the running guacd process. Users are recommended to upgrade to version 1.6.0, which fixes this issue.

Description

A presentation at Black Hat EU 2023 discussed credential stealing on mobile password managers. Keeper was listed as an impacted application. Keeper has safeguards in place to protect against this issue as described below.

NIST Link

Description

Enhancements:

• VAUL-6715: Improved KeeperFill Installation Prompt: The installation prompt for KeeperFill has been enhanced to offer a better user experience.

• VAUL-6716, VAUL-6789: Enhanced Import Functionality: When importing data from Keepass KDBX files, TOTP fields will now be correctly recognized and imported as Keeper TOTP fields, ensuring better accuracy and usability.

• VAUL-6748: Password Complexity and Generation: Password complexity rules can now be applied independently without generating a new password, offering more flexibility in managing your passwords.

Security Updates

• KDE-1425: Heap buffer overflow vulnerability in the libvpx library. Updated Electron framework.

Bug Fixes

• VAUL-6150: Shared folders are not instantly removed on team removal

New Features

• VAUL-5652: Recovery Phrase. We have upgraded our account recovery process with a new and more secure 24-word “recovery phrase” feature. Read more on the .

Bug Fixes

• VAUL-5551: Extension not auto-logged in if installed while Web Vault currently logged in

Bug Fixes

• Multiple Tickets: Several UI bugs, translations and visual fixes

Features

• VAUL-5029: Introducing One-Time Share. See the and for more details.

Features & Improvements

• KDE-1193: Include TOTP fields in LastPass automated import

Accessibility (508 Compliance)

• Keeper has been making UI changes across all web-applications and browser extensions to comply with Section 508 of the Rehabilitation Act (29 U.S.C. § 794d). The Keeper Web Vault and Desktop App now supports keyboard navigation and they are compatible with popular screen readers and other assistive technology.

New Features & Improvements

• Expansion to AU Data Center - Keeper now supports an AU data center. Users have the option to select "AU" from the region selector at login for Keeper Desktop App.

NIST Link

Description

New Features

• New "Shared Records Report" added to the Export screen:

Bug Fixes

• VAUL-5024: Record Type records not syncing after activating Record Types

• VAUL-5018: Showing "unexpected error" when creating account with a pending transfer acceptance

Bug Fixes

• VAUL-4472: "Salt/Iterations" error message when Master Password user tries to login with the SSO Alternate Master Password login screen.

Improvements

• VAUL-4589: Support for Avast password import

Benefits & Enhancements

• Support Email Address Change - Enterprise (SSO) users now have the ability to change their email address from their Vault (if role enforcement policies allow).

Benefits & Enhancements

• Password Importer Update - The Keeper Import Tool has been updated to version 14.0.6, supporting Brave, Chromium and Edge browsers along with several bug fixes.

Bug Fixes

• VAUL-4549: Unable to reset Master Password with Browser Extension v15.0.2 installed

Bug Fixes

• Resolve data import issues with version 16.4.2 that caused crashes on the Browser Extension and Android app. See resolution page: -->

Bug Fixes

• VAUL-5079: Unable to login with Internet Explorer 11

Improvements

• VAUL-5032: 508 Accessibility updates (checkboxes, menus, contrast and resizing)

Improvements

• VAUL-5653: Force auto-update all users to 1,000,000 PBKDF2 iterations

• VAUL-5655: Switch transmission key from RSA to EC

Bug Fixes

• KDE-1333: LastPass import missed some custom fields such as SSH keys

Bug Fixes

• Fixed: The import instructions from a ZOHO file are incorrect causing fields to not parse correctly.

• Fixed: User receives error when attempting to import a .csv file with three fields.

• Fixed: Import instructions missing for JSON files.

• Fixed: Automated import form LastPass is unresponsive and no longer displays progress animation.

Bug Fixes

• VAUL-4643: Login hangs when a user converts from Master Password to SSO Cloud login.

• VAUL-4644: Record "info" screen sometimes does not return the user information in Last Modified date.

Bug Fixes

• Fixed: New Enterprise users (non-SSO) are prompted for device approval prior to account creation.

• Fixed: User login to web vault from browser extension fails on IE11 browsers.

Bug Fixes

• VAUL-4487: Users who created their account prior to several years ago, who are part of an Enterprise without a Master Password policy, with a Master Password that is less than 10 characters, are being prompted to change their Master Password upon logging into the vault. However, the resulting flow is not enforcing the 10-character minimum, so the user may enter into a confusing loop. This issue is being fixed EOB today.

Improvements

• KDE-940: Removed legacy PBKDF2 Iteration settings

• KDE-939: "Stay Logged In" setting now appears on the Keeper Desktop application.

Description

At DEF CON 33, a researcher presented on Clickjacking (UI redressing), where users can be tricked into clicking hidden UI elements. The researcher showed a scenario in which a malicious site could prompt a user to click on a transparent password manager autofill interface.

Keeper already blocks cross-domain autofill but collaborated with the researcher to further strengthen the browser extension as described below. We value the security research community and regularly collaborate with researchers to help protect our customers.

Timeline

• Apr 9, 2025: Researcher reported the issue. Keeper classified it as low severity since autofill from untrusted domains is already blocked.

• Apr 15, 2025: Engineering delivered a patched test build to the researcher within 8 days. Researcher noted the fast response.

• May 26, 2025: Fix released in browser extension v17.1.2 (see ).

Keeper's Protection

Keeper’s browser extension is designed to autofill credentials and payment information only on websites explicitly saved by the user. This creates a trust relationship between the user and the destination website. Keeper does not allow cross-domain autofill under any circumstances.

Users can optionally enforce stricter matching by requiring a full subdomain match for autofill. This behavior can be enabled via the browser extension’s settings, and it can also be enforced organization-wide by administrators through role-based policies in the Keeper Admin Console.

Autofill of payment cards and address information only occurs if the site matches a saved record in the user's vault, and the user has explicitly saved those details for the site. If a match does not exist, the user must manually confirm the autofill operation through a native popup dialog.

Reported Behavior:

The scenario reported by the researcher required:

1. Explicitly saving a Keeper record for a malicious or compromised website to your vault,

2. Visiting that site again, and

3. Interacting (clicking multiple times) on UI elements overlaid with a transparent Keeper autofill interface.

In this context, the user has already trusted the website by saving credentials to their vault with the exact root domain of the website. There is no vector for a different, unrelated root domain to initiate autofill without this precondition.

Because this relies on the user already trusting and saving the same domain, there is no cross-domain attack vector. The issue was therefore rated low severity, but Keeper implemented additional protections as a precaution.

Updating

The Keeper Browser Extension v17.2 updates automatically across Chrome, Firefox, Edge, Safari, Brave, and other Chromium-based browsers. No further action is required by users.

Contact

If you have any questions, please email us at [email protected].

NIST Link

https://nvd.nist.gov/vuln/detail/CVE-2023-5217

Description

Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Impact to Keeper

Keeper Security may have been impacted by this vulnerability in the Desktop App since we use the Electron framework. As a precaution, we immediately updated to Electron framework version to v22.3.25 and published .

If you have any questions, please email us at [email protected].

NIST Link

https://nvd.nist.gov/vuln/detail/CVE-2023-36266

Description

A researcher filed a CVE (CVE-2023-36266) in regards to the scanning of local memory when using Keeper Desktop and browser extension software.

Impact to Keeper

We have disputed this CVE. Keeper performs quarterly pen testing with 3rd party experts including , and independent security researchers against all of our products and systems. Keeper has also partnered with to manage its vulnerability disclosure and bug bounty programs. As part of our testing, we explicitly test the storage of secrets in memory while our applications are in use, and when logged out. Keeper removes all decrypted vault data from memory upon logout and provides settings to also wipe memory and restart the app upon vault auto-lock. This functionality has been verified by our pen testers and the test results are available for customer review.

As with any software product, if an attacker controls the local computer, the attacker can perform any action the user or an application could perform. In the case of a password manager, if an attacker can read arbitrary memory, then an attacker can read decrypted contents of the password manager while the application is in use. This applies to any password management product. Security researchers understand that a fully compromised device scenario has severe implications for the user.

Keeper has multiple security mechanisms in-place to defend against compromised end-user devices. Keeper client software only decrypts the user's vault upon successful login, and only stores decrypted values during use in volatile memory. When a user is logged out or timed-out, decrypted values are removed from memory. In addition, the Keeper desktop application provides a setting in the "Security" screen which forces a full application restart upon auto-logout, to ensure that data is cleared upon locking. In the case of a web browser such as Chrome, Keeper requests the clearing of memory after logout, however the memory management of the underlying browser is outside of Keeper’s control and can sometimes take time for the memory management system to complete this operation.

With all end-user software, it's important to ensure that users reduce the risk of a compromised device by following security best practices, keeping all software up-to-date and installing adequate antivirus / malware protection software.

Keeper has stood by its commitment to protect your most valuable data for more than a decade, through our best-in-class Zero-Knowledge and Zero-Trust security model and transparent approach to sharing it with the public. For information regarding Keeper's security and encryption model, please visit:

If you have any questions, please email us at [email protected].

Downloads

Keeper for iOS is available at the Keeper download page.

User Guides

The iOS user guide is with additional info about autofill and passkey setup .

iOS Missing Payment Cards

If your payment cards are missing, go to Keeper > Account tab > Sync > Sync Now.

iOS Stuck on Syncing

If you are seeing syncing stuck on the screen, please check the following:

• Update to the latest version of Keeper on the App Store

• Instead of logging in with biometrics, try to login with your Master Password (clicking "Next")

• After a successful login, visit the settings screen of Keeper and turn OFF/ON the Face ID or Touch ID setting.

Syncing, Updates and Device Approvals

If adding a password on your desktop doesn't automatically sync down your mobile device, ensure that push notifications are enabled.

iOS and Android apps use push notifications for functionality such as:

• Realtime sync

• Device approvals

• Sharing notifications

Please ensure that push notifications for Keeper are enabled on your device (Settings > Notifications > Keeper and enable "Allow Notifications"). Also, "Do Not Disturb" mode will prevent certain notifications from appearing. Device approvals will not be received if you have iOS in Do Not Disturb mode.

Other iOS Issues

Having issues on iOS? You may need to simply clear the cache on your device and reset the app settings. But before you do that, please make sure your data is fully available on the Keeper Web Vault or Desktop App.

• On the front door of the Keeper app, tap on "Need Help?" then tap Reset Keeper.

• Launch Keeper and Login to your account.

• You will be asked to approve the device during the login process.

Feature Requests

We love hearing from iOS customers. Send your feature requests to: [email protected].

Beta Slack Channel

Join our to post questions, feedback or receive new beta versions.

Downloads

Keeper for Android is available at the Keeper download page.

User Guides

The Android user guide is with additional info about autofill and passkey setup .

Syncing Errors

If you are receiving an error on your mobile app, please make sure to update to the latest version. After you update, we recommend performing a Full Sync by clicking on Sync > Sync Now. This tends to resolve any searching or record-related issues.

Syncing, Updates and Device Approvals

If adding a password on your desktop doesn't automatically sync down your Android device, ensure that push notifications are enabled.

Android apps use push notifications for functionality such as:

• Realtime sync

• Device approvals

• Sharing notifications

Please ensure that push notifications are enabled for Keeper from your device's settings menu. Also, "Do Not Disturb" mode will prevent certain notifications from appearing.

Other Android Issues

Having issues on iOS or Android? You may need to simply clear the cache on your device and reset the app settings. But before you do that, please make sure your data is fully available on the Keeper Web Vault or Desktop App.

• Go to your device Settings icon, and then tap on the Applications menu. Scroll down until you see the Keeper icon and tap on it. Click on the Clear Data button, and then click OK. The next time you load Keeper, it will be reset to its original settings. Another way is to press-and-hold on the Keeper icon, then open the application info and clear the data.

• Re-install Keeper from Google Play on your device

• Launch Keeper and Login to your account. You will be asked to approve the device during the login process.

Feature Requests

We love hearing from Android customers. Send your feature requests to: [email protected].

Beta Slack Channel

Join our to post questions, feedback or receive new beta versions.

When a major release is planned, Keeper publishes a Preview version of the Vault and Desktop app, documented below. The pre-release version is typically published 1 week before public release.

Web Vault Preview

• US:

• EU:

• AU:

Desktop App Preview with Forcefield

Keeper Desktop is a native application for Windows, macOS and Linux platforms. On Windows devices, this is bundled with the service.

• Mac (.dmg) -

• Mac (.pkg) -

• Windows (.appx) -

• Windows (.msix) -

Standalone Forcefield Preview

Keeper Forcefield can also be deployed on a standalone basis, without the Keeper Desktop application. The URL and MSI installer for the Forcefield preview is available here:

Send feedback to: [email protected]

Enhancements

• VAUL-4284: Added numerous updates to KeeperAI threat detection across PAM resources, PAM configuration settings, gateway settings and session history. about KeeperAI for privileged sessions.

• KDE-1639: Published Keeper Desktop to Snap store for Linux. Snapcraft (and Snaps) are used on numerous Linux distributions, including Ubuntu, Debian, Fedora, RHEL, CentOS, AlmaLinux, Rocky Linux, Linux Mint, Manjaro, and openSUSE. Snap link:

• KDE-1738: We've rewritten the entire Hotkey system in the desktop application from the ground up.

  • Addressed several reported inconsistencies between macOS and Windows platforms.

  • Hotkeys can now be further customized with any character or symbol.

  • You can allow virtual input from software like Synergy or 3rd party applications to optionally control hotkeys.
• The Password Importer standalone executable for Microsoft Windows has been improved to import passwords stored in Chrome. NOTE: Enterprise customers may need to add an exclusion policy on their EDR platform if Keeper is flagged.

Bug Fixes and Improvements

• VAUL-7455: We fixed an issue where PAM features were displayed even when the user didn’t have the required enforcements.

• VAUL-7612: We fixed an issue where the password generator did not retain the length of the previous password.

• VAUL-7252: We enhanced the search bar accessibility on smaller screens.

• VAUL-7633: We fixed an issue where selecting and unselecting options when creating a Gateway did not preserve the previous form state.

Enhancements

• VAUL-6349: Updated the Security Audit tab in Vault to ensure the overall Security Audit score matches the per-user score in the Admin Console, reducing confusion.

Other Updates

• KDE-1534: Updated new installs to default to the native browser for SSO authentication instead of the app browser.

• VAUL-7176: Fixed an issue where setting up a hardware security key required extra steps; the Vault now prioritizes it using the “hints” syntax.

• VAUL-7262: PAM Updated router calls to use the /api/user path for commands.

Bug Fixes

• KDE-1607, 1606, 1608, and 1619: The SSH Agent will scan General typed records for private key file attachments

• KDE-1611: Fixed an issue where selecting Two-Factor Authentication triggered the Offline Access dialog.

• VAUL-7094: Fixed an issue preventing master password login when session resumption and 2FA were enabled

• VAUL-6787: Fixed an issue where the folder structure in Delete Items did not match the folder structure in Vault.

KeeperPAM is now available for all customers. Keeper Vault 17.1 and newer is required to access the new privileged access management features.

For more information on KeeperPAM, visit the following:

• Website

New Features

• - manage all rotations directly from the Vault UI

• - instantly and securely access assets within their target infrastructure

• - use native apps for establishing remote access

• - protect web-based apps

Improvements

• Browser tab now shows username: "Keeper® Vault - [email protected]"

Enhancements

• VAUL-6966: Updated the vault login screen animations to stop after 30 seconds

• VAUL-6606: Updated the remaining router API endpoints to enhance performance and security.

• VAUL-6785: Adjusted the location of the visibility "eyeball" icon for long passwords, ensuring consistent UI across all record views.

• VAUL-6821: Introduced a new dialog that users are required to accept when being invited to a managed enterprise. Letting users know the enterprise administrator has the ability to manage their vault in accordance with company policies.

• VAUL-6866: Updated URL handling to restrict it to standard HTTP/HTTPS protocols, improving security and validation.

• VAUL-6869: Updated the title and meta description of the settings page to enhance SEO and search engine visibility.

Bug Fixes

• VAUL-5853: Addressed formatting inconsistencies within custom record types for Security Q&A fields.

• VAUL-5898:Fixed an issue where using the search and location filter together resulted in invalid or unexpected search results.

• VAUL-6051: Fixed an issue where the UI adjusted incorrectly after closing an error message generated by an invalid value in the native app filler.

• VAUL-6247

New Features and Improvements

• Introducing Record Types for Web Vault & Desktop App (Limited Release) This release introduces a powerful new feature called "Record Types", which gives users the ability to create records of various template types, grouped into categories, each containing a unique collection of field types and functionality fields within the record. Record templates can be created by Admins that are custom to the needs of the business. This feature is only available for Enterprise customers, activated on an individual basis at this time, because the Browser Extension, iOS and Android apps are still under development. If you are interested in being an early adopter of Record Types, please contact your customer success team member at Keeper and we'll activate the feature.

• Generate a Password in KeeperFill for Apps Keeper's password generator is now within easy reach in the KeeperFill for Apps toolbar landing screen. Users can generate and copy the secure password or use it to create a new record.

• Comprehensive Keyboard Command Functionality for KeeperFill for Apps

• Support for NTLM Authentication for Microsoft Windows Customers

Bug Fixes

• KDE-959: The "Session Timed Out" dialogue appears when logging into a different account after a session timeout occurs

• KDE-1034: When a user attempts to switch from US to EU region at login, an Uncaught TypeError is returned

• KDE-977: Selecting "Create an Account" in KFFA opens the login page on Keeper Desktop

• VAUL-4721: The "Admin Console" button in the Vault fails to redirect Enterprise users to the console

Improvements

• VAUL-4547: Support for Kaspersky password import

• VAUL-4552: Admins now receive a warning before removing themselves from a shared folder

• VAUL-4566: Improved performance handling of vaults with large data sets

• VAUL-4551: Enterprise users to receive notification with explanation for Master Password change and complexity requirements upon login

Bug Fixes

• KDE-945: User receives error message after closing Desktop App and relaunching

• KDE-962: "About Keeper" options menu fails to appear after first launch of Desktop App on Windows

• KDE-972: KeeperFill for Apps fails to respond to hotkeys when switching between apps

• KDE-973: Recipient of a shared record is required to login again after the shared record has been edited

Features

• KDE-990: Support for logout timer with more than 1440 minutes

Bug Fixes

• KDE-1021: Errors when logging into Azure

• VAUL-4643: Login hangs when a user converts from Master Password to Cloud SSO

• VAUL-4644: Record "info" screen is not showing the user who made the change

• KDE-839: Update Electron framework dependencies

New Features and Improvements

• VAUL-4710: Secrets Manager user interface is now generally available on the Keeper Web Vault and Desktop App. For more information about Keeper Secrets Manager, see:

  https://docs.keeper.io/secrets-manager

• VAUL-4904: Visual improvements and workflow improvements for Record Types template creation.

• VAUL-5062: Added MyKi password manager to Keeper Import screen

Security Updates

• VAUL-5038: Migrated from webpack4 to webpack5

• KDE-1163: Additional changes to ensure that logout clears all memory. User-initiated logout performs full restart of the Keeper Desktop application.

Bug Fixes

• KDE-1164: KeeperFill for Apps will only process hotkeys when a record has been selected. This prevents conflicts between existing hotkeys and KeeperFill.

• KDE-1169: Sync errors after deleting a Shared Folder

• KDE-1168: "Object no longer exists" error when switching between KFFA and Desktop App

Features & Improvements

• VAUL-5035: Ability to convert "general" to new Record Types

• VAUL-4879: Role enforcement to activate Stay Logged In

• VAUL-4893: Role enforcement to enable Self Destruct

• VAUL-5201: Improved performance of uploads and downloads

Bug Fixes

• VAUL-5187: QR Code upload fails for certain formats

• VAUL-5202: MyKi and 1Password TOTP record imports are not autofilling*

  (*) To resolve existing records, run the verify-records command in .

• VAUL-5191: TOTP and custom fields not available in CSV export

Improvements

• KDE-1150: Support for CCH Axcess native app autofill

• VAUL-4991: Changed Software License Number to a hidden field

Bug Fixes

• KDE-1157: Improved support for Azure Conditional Access

• KDE-1156: Remove use of legacy windows registry key which generates a report in Cybereason

• VAUL-5036: Restore of Record Type records

• VAUL-5018: Showing "unexpected error" when creating user accounts with a pending transfer acceptance

Benefits & Features

• New "Help" Button - A "Get Help" button has been integrated into the Vault login page. Upon clicking this button, the user will be prompted to select either "Forgot Master Password" or "Get Help". "Get Help" redirects the user to Keeper's Support page where our user guides and Support Team can be reached.

• Enhanced Enterprise Authentication Flow - Keeper has launched a new authentication flow for our customers with Enterprise plans that simplifies deployment and usability while enhancing security.

  • If Keeper recognizes an end user’s email domain as an SSO-enabled Enterprise, the user will be automatically routed to their identity provider instead of having to type in the Enterprise Domain string.

  • For Master Password users, if a device is recognized, and 2FA is activated, the user will receive a prompt prior to typing in their Master Password.

Bug Fixes

• Fixed: An error message fails to appear when a user has reached device approval limit.

• Fixed: Upon logging into the vault, the device approval Keeper Push prompt displays a key value.

• Fixed: When an SSO user attempts to delete all their owned records they a incorrectly prompted to enter a Master Password.

Description

Keeper Security is aware of the , where cybercriminals accessed client files through its support system. As part of its support process and system, Okta’s customers upload HTTP Archive (HAR) files which contain sensitive information from the user's web browser. This information included session tokens that were used to impersonate several Okta customers.

Security Updates

Keeper Desktop version 17.2 includes the installation and activation of Keeper Forcefield. Keeper Forcefield is an advanced endpoint security product for Windows that protects sensitive applications and processes from unauthorized access. It is specifically designed to defend against threats such as memory scraping and credential harvesting from malicious software installed via phishing or other attacks.

More info:

• Website:

Features

The 16.11.0 release contains several new features, including , , and .

Passphrases

Keeper is proud to announce our release of version 16.9.0 of our Web Vault and Desktop App. This new version includes a new design with a user interface refresh along with some new features and bug fixes.

See our blog post for additional details:

New Features

Features

• VAUL-5165: Offline Create/Edit Record capability

This is a bug fix release that mainly focuses on the new Record Types feature (still in beta). Therefore most customers are not affected by the bug fixes listed below.

Bug Fixes

• KDE-1077: Logout from KeeperFill for Apps generates an error

Bug Fixes

• Fixed: The Web Vault logs out ahead of the browser extension and generates error messages

Benefits & Enhancements

KeeperFill for Apps Redesign - This release entails a comprehensive design and technical update of KeeperFill for Apps, dramatically enhancing the user experience with the Keeper Desktop App. The Desktop App window can now be closed but remain running and accessed through the system tray via the familiar Keeper icon.

Many of the existing features of Keeper's Desktop App can now be applied through KeeperFill for Apps, such as: filling credentials and launching websites, viewing all records and favorites, adjusting settings, and accessing Keeper's User Guides. Additionally, within the Settings menu, the following KeeperFill hotkey actions can be customized by the user, further streamlining their experience with Keeper for Desktop:

Features & Enhancements

• Login V3 General Availability (GA) More information available here:

Special Notes

• Password Complexity requirements are checked upon every login, not just during Master Password Reset. If you have a user being asked to change your Master Password, they are likely using a password that does not meet the policy requirements.

Bug Fixes

• KDE-933: Fix for minor UI display issue

• KDE-932: User unable to proceed past 2FA timeout screen and return to login upon clicking "OK" button when prompted

Features & Enhancements

• Privacy Screen - Admins now have the ability to control the viewing (unmasking) of passwords based on a specified domain. Additionally, it prevents the user from changing the website URL after the record has been saved. This policy is enforceable by the Admin for individual domains within each of their Generated Password Complexity settings by enabling "Apply Privacy Screen".

Enhancements & Benefits

• VAUL-4459: SSO Cloud users are able to auto-login and logout to the vault and browser extension simultaneously.

New Features & Improvements

• Support for Azure Conditional Access on the Keeper Desktop application for users who login with Single Sign On. Previously, Azure Conditional Access policies could not be added to Keeper.

Benefits & Enhancements

• Support for Chrome v80 Password Import - Support established for the import of passwords from Chrome v80 and newer on Windows devices.

Improvements

• VAUL-6523: Added pin code generator to "Pin Code" custom field

• VAUL-6595: Improved 508 compliance for "Record Types" default actions

  • Escape key closes "Record Types"

• VAUL-6596: Enhanced 508 compliance for "More Filters" default actions

  • Escape key closes "More Filters"

• VAUL-6597: Fixed issues with 508 compliance regarding possible actions. Dropdown lists out of focus are automatically closed

• VAUL-6648: Updated support information that appears in the vault directing users to:

Bug Fixes

• VAUL-6550: Implemented a modal warning for trials expiring within 24 hours

• VAUL-6747: Removed offensive words from the word list

• VAUL-6613: Updated strength indicator to prevent it from turning green erroneously

• VAUL-6721: Fixed the default passphrase separator issue

Features

• VAUL-5688: Support for Passkey record fields. Managing passkeys requires browser extension 16.6.0 which was released on Aug 7, 2023. Learn more about passkeys here.

• VAUL-5977: Support for RESTRICT_IMPORT_SHARED_FOLDERS enforcement policy which will prevent users from importing shared folders from LastPass. See the Admin Console role enforcement policies to enable this setting.

• VAUL-5502: Support for new paginated sync system on the backend API

• VAUL-5999: Support for Swedish and Finnish languages

• VAUL-5628: Date fields are searchable

• VAUL-5580: Email addresses are auto-sanitized when pasting into sharing screens

Bug Fixes

• KDE-1376: Desktop app can get stuck when the main app is closed too quickly

• KDE-1381: Offline records not syncing up properly in Linux

• KDE-1382: RPM desktop installer not compatible with RHEL9

Other Changes

• VAUL-5899: Improved loading and search speed for large vaults

• KDE-1343: Remove the deprecated browser extension for Safari users, point users to the new App Store version of the Safari extension

• VAUL-6110: Removed the manual on/off toggle for logout timer. Users must specify a time (in minutes).

Features

• Share Admin Keeper's Share Admin feature is a role-based permission that gives administrators elevated access rights over your organization's shared folders and shared records. Share Admins have full user and record privileges for any shared record that they have access to. See: https://docs.keeper.io/enterprise-guide/share-admin

• MSP to Managed Company Team Sharing Directly share folders to Managed Company teams

• General to Record Type Conversion You can now right-click to change the type of any record, including migration from the legacy "General" record types. Multi-select + right click allows migration of multiple records at once.

• Default Record Permissions Quickly set permissions during the creation of a Shared Folder

• Default Folder Settings moved into the "Settings" tab In addition, you can now apply permission changes recursively and retroactively.

• Shared Folder UI improved visibility Several enhancements to the UI which improve the visibility and management of Shared Folders.

• Team Visibility There is now a "View Team" function in several locations so that you can see who you're sharing to.

• Collapsed View of Records When a folder contains subfolders and records within subfolders, you can now collapse the view, in order to apply changes recursively. Select "Show subfolder records" to collapse the list.

• Retroactively apply permissions When "Show subfolder records" is selected, the Settings tab will display a checkbox called "Apply permissions to all subfolders" which will apply the default folder settings to all existing records within folders and subfolders.

Features and Improvements

• KDE-1111: Native App Filler custom field type for Record Types which provides automated filling of native applications with application title matching, keystroke macros and advanced OCR for recognition of window content for automated record selection. More information about this feature can be found here:

  https://docs.keeper.io/user-guides/keeperfill-for-apps#native-app-filler

• VAUL-4907: Support for Webauthn with automatic U2F->Webauthn transition

• VAUL-4945: Import/Export support for Record Types

• VAUL-5069: Support for Psono password import

• VAUL-5006: Support for partial email search during Sharing for customers with over 500 users.

• VAUL-5046: Display changes made on the record history screen

• VAUL-5063: Allow record owner to change URL on Privacy Screen records.

• VAUL-5016: Allow users in a shared folder to duplicate records

• VAUL-4989: Allow users who are shared to a record (non-owner) to duplicate records

• KDE-999: Automated LastPass import will convert Templates and Custom Fields into Keeper Record Types and Custom Fields

Bug Fixes

• KDE-1185: Conditional access blocking usage of Desktop App in certain environments

• VAUL-5067, VAUL-5073: Secrets Manager client device bug fixes

• VAUL-5968: SSO Cloud login hangs when the device has been locked

Downloads

All KeeperFill browser extensions are available at the .

Downloads

All Keeper Desktop apps are available at the .

Features & Improvements

• KDE-1090: Upgraded Electron framework to 17.x

Features

• VAUL-6175: Added thousands of popular website logos to the Vault user interface.

The implementation of website logos preserves full zero knowledge encryption and privacy. The entire library of logo files are embedded within the vault application.

• KDE-1403: Optional SSO login method through default web browser

If the new "Use Default Browser for SSO" option is enabled from the desktop application menu, the user will be routed to their default web browser on the device in order to login with their configured identity provider.

The primary reason for implementing this feature is to support SSO identity providers who support FIDO2 security keys or other authentication methods that are not technically supported from the Keeper Desktop embedded browser.

For Admins who would like to enforce this to all desktops, a new item called UseDefaultBrowserSSO is available.

• DR-265: Ability to specify time zone and hour of day for scheduled password rotations

• VAUL-5620: Enhancements for Recently Deleted page

• VAUL-5686: Security Audit screen now has a "Last Change" column

• VAUL-6138: New "Advanced" settings menu which contains the following features:

Bug Fixes

• VAUL-6135: Currently only owner and share admin can update permissions, add/remove users, set/update expiration timers. User with can_share right should be also able to manage users up to its own level of privilege.

• VAUL-5659: Multiple Record Selection is not working in Deleted Items

• KDE-1421: Records created while in offline mode are not syncing properly when going online

Security Updates

• VAUL-6170: Security improvements using CryptoKey storage on Firefox browsers for device keys

• VAUL-6179: Convert ECIES-encrypted Record Keys to Data Key-encrypted Record Keys upon login.

• KDE-1406: New desktop app installs will now store device private keys in the Apple Keychain or Windows Credential Locker instead of Chrome CryptoKey local storage, for improved security for native app installation. Existing keys will not be transferred until a reset takes place.

Other Improvements

• KDE-1417: When filling into a remote desktop session using mstsc.exe, incorrect characters are used with a different keyboard layout than the host machine.

• VAUL-6219: Improved the automatic team-user approvals upon logging in. This new method handles a large number of pending users.

• VAUL-6200: When viewing a deleted record, file attachments cannot be downloaded until the record is restored.

Known Issues

• Migrating from LastPass using Okta SSO saying "Import Error"

In the Okta Admin portal under Applications, locate your "LastPass Okta Login" application. Under the "Sign-in redirect URIs" section, add the following URI: http://localhost/ then click "Save".

Enhancements

• VAUL-7458, KDE-1799: Fixed an issue causing slow file uploads in KeeperPAM connections.

• KDE-1790: Integrated

Enhancements