Skip to content
OpenAdvisories
High WID-SEC-2026-1285 6 CVEs

Vaultwarden: Mehrere Schwachstellen

Published Apr 26, 2026 · Updated May 12, 2026 · Revision 4 · de-DE

Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Vaultwarden ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um einen Denial of Service Angriff durchzuführen, und um Informationen offenzulegen.

Product

Vaultwarden ist eine alternative Implementierung der Server API des Bitwarden Passwort-Managers.

Vulnerabilities 6

  • High 8.7
    CVE-2026-43912

    Vaultwarden: Cross-Org Group Binding Enables Unauthorized Read And Write Access Into Another Organization

    Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.35.5, Vaultwarden does not enforce that a groups_users.users_organizations_uuid entry belongs to the same organization as groups.groups_uuid, or a collections_groups.collections_uuid ent…

    dani-garcia vaultwarden
  • High 8.1
    CVE-2026-43913

    Vaultwarden: Unconfirmed Owner Can Purge Entire Organization Vault

    Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.35.5, Vaultwarden allows an unconfirmed organization owner to purge the entire organization vault. The organization invite flow uses a two-step process: accepting an invite transitions m…

    dani-garcia vaultwarden
  • High 7.3
    CVE-2026-43914 Public exploit

    Vaultwarden: Brute-force protection bypass vulnerability

    Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.35.4, there is a security vulnerability in Vaultwarden that allows bypassing the login brute-force protection if email 2fa is enabled. If email 2fa is enabled, the unprotected 2fa-functi…

    dani-garcia vaultwarden
  • Medium 6.8
    CVE-2026-43911

    Vaultwarden: Refresh tokens not invalidated on security stamp rotation

    Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.35.5, refresh tokens are not invalidated when the user's security_stamp is rotated by some security-sensitive operations (password change, KDF change, key rotation, email change, org adm…

    dani-garcia vaultwarden
  • Medium 5.3
    CVE-2026-31835

    Vaultwarden WebAuthn credential metadata tampered before signature verification

    Vaultwarden is a Bitwarden-compatible server written in Rust. In versions 1.35.4 and earlier, the WebAuthn authentication flow in `validate_webauthn_login()` updates persistent credential metadata (1backup_eligible1 and 1backup_state flags1) based on unverifi…

    dani-garcia vaultwarden
  • Medium 5.3
    CVE-2026-33420

    Vaultwarden missing authorization check allows Manager-role users to enumerate all collections

    Vaultwarden is a Bitwarden-compatible server written in Rust. In version 1.35.4 and earlier, the get_org_collections_details endpoint (GET /api/organizations/{org_id}/collections/details) is missing the has_full_access() authorization check that exists on the…

    dani-garcia vaultwarden

Revision history

  1. #4

    Referenz(en) aufgenommen: 2476356, 2476359, 2476363

  2. #3

    CVE's ergänzt

  3. #2

    Referenz(en) aufgenommen: EUVD-2026-27448, EUVD-2026-27424

  4. #1

    Initiale Fassung

References