bitwarden/server vulnerabilities

Latest bitwarden/server CVEs

Newest publication first

1. CVE-2026-119414 Bitwarden Server before 2026.10.1 Authorization Bypass via POST /api/ciphers/create

   Published 2026-10-30

   Medium·CVSS 5.3 EPSS 0.36%

   Bitwarden Server before 2026.10.1 on Entity Framework backends contains an authorization bypass vulnerability that allows organization members to add ciphers to collections they cannot edit. Attackers can call POST /api/ciphers/create, where a nulled UserId is treated as administ...

2. CVE-2026-101878 Bitwarden Server 2025.6.0 < 2025.6.0 Authentication Bypass via SSO Identifier Truncation

   Published 2026-09-29

   High·CVSS 7.7 EPSS 0.26%

   Bitwarden Server 2025.6.0 before 2026.5.0 declares the @ExternalId parameter of the User_ReadBySsoUserOrganizationIdExternalId stored procedure as NVARCHAR(50) while the column it queries stores NVARCHAR(300), silently truncating the SSO login identifier on SQL Server deployments...

3. CVE-2026-71959 Bitwarden Server < 2026.7.2 Audit Log Injection via POST /collect

   Published 2026-08-10

   Medium·CVSS 6.9 EPSS 0.48%

   Bitwarden Server before 2026.7.2 does not verify that the caller is a member of the organization identified in a POST /collect request body, allowing any authenticated user to write forged, arbitrarily backdated entries into any organization's audit log.

4. CVE-2026-60104 Bitwarden Server < 2026.6.0 Authorization Bypass via Admin Auth Request

   Published 2026-07-08

   Critical·CVSS 9.3 EPSS 0.37%

   Bitwarden Server before 2026.6.0 does not verify that the email in a POST /auth-requests/admin-request body belongs to the authenticated caller, allowing a low-privileged organization member to obtain another user's vault key and a victim-scoped access token by creating a Trusted...

5. CVE-2026-57522 Bitwarden Server < 2026.5.0 JSON Injection via Webhook Templates

   Published 2026-06-25

   Low·CVSS 2.3 EPSS 0.46%

   Bitwarden Server before 2026.5.0 contains a JSON injection vulnerability in IntegrationTemplateProcessor.ReplaceTokens(), which substitutes user-controlled values into event-integration templates without JSON encoding. When an organization has configured an event integration whos...

6. CVE-2026-57521 Bitwarden Server < 2026.5.0 Broken Access Control via PreviewInvoiceController

   Published 2026-06-25

   Medium·CVSS 5.3 EPSS 0.43%

   Bitwarden Server before 2026.5.0 contains a broken access control vulnerability that allows any authenticated user to access arbitrary organization billing data by supplying an arbitrary organizationId to the PreviewInvoiceController endpoints without membership or authorization...

7. CVE-2026-57520 Bitwarden Server < 2026.5.0 Privilege Escalation via Bulk User Remove Endpoint

   Published 2026-06-25

   High·CVSS 7.1 EPSS 0.64%

   Bitwarden Server before 2026.5.0 contains a privilege escalation vulnerability that allows authenticated Custom users with ManageUsers permission to remove Admin accounts from an organization by exploiting a missing role hierarchy check in the bulk user-remove endpoint. Attackers...

8. CVE-2026-43640 Bitwarden Server < 2026.4.1 Authentication Bypass via SCIM API Key

   Published 2026-05-11

   High·CVSS 8.6 EPSS 0.50%

   Bitwarden Server prior to v2026.4.1 does not require master-password re-authentication when retrieving or rotating an organization's SCIM API key, allowing an authenticated user with SCIM management privileges to obtain the key using only a valid session.

9. CVE-2026-43639 Bitwarden Server < 2026.4.0 Missing Authorization via Provider Clients

   Published 2026-05-11

   High·CVSS 8.9 EPSS 0.60%

   Bitwarden Server prior to v2026.4.0 contains a missing authorization vulnerability that allows a provider service user to add an arbitrary organization to their provider via POST /providers/{providerId}/clients/existing, resulting in takeover of the target organization; self-host...

10. CVE-2026-43638 Bitwarden Server < 2026.4.1 Missing Authorization via Organization Cipher Import

    Published 2026-05-11

    Medium·CVSS 5.3 EPSS 0.19%

    Bitwarden Server prior to v2026.4.1 contains a missing authorization vulnerability that allows any authenticated user to write ciphers into an arbitrary organization via POST /ciphers/import-organization by submitting an empty collections array, which causes the server-side permi...

11. CVE-2020-15879 Bitwarden Server 1.35.1 allows SSRF because it does not consider certain IPv6 addresses (ones beginning with fc, fd, fe, or ff, and the :: address) and certain IPv4 addresses (0.0.0.0/8, 127.0.0.0/8,....

    Published 2020-07-21

    High·CVSS 7.5 EPSS 2.7%

    Bitwarden Server 1.35.1 allows SSRF because it does not consider certain IPv6 addresses (ones beginning with fc, fd, fe, or ff, and the :: address) and certain IPv4 addresses (0.0.0.0/8, 127.0.0.0/8, and 169.254.0.0/16).

12. CVE-2019-19766 The Bitwarden server through 1.32.0 has a potentially unwanted KDF.

    Published 2019-12-12

    High·CVSS 7.5 EPSS 1.3%

    The Bitwarden server through 1.32.0 has a potentially unwanted KDF.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.