Skip to content
OpenAdvisories
High WID-SEC-2026-1465 3 CVEs

Bitwarden: Mehrere Schwachstellen

Published May 11, 2026 · Updated May 11, 2026 · de-DE

Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Bitwarden ausnutzen, um Sicherheitsvorkehrungen zu umgehen, und um seine Privilegien zu erhöhen.

Product

Bitwarden ist eine Open-Source-Lösung für die Passwortverwaltung.

Vulnerabilities 3

  • High 8.1
    CVE-2026-43640

    Bitwarden Server < 2026.4.1 Authentication Bypass via SCIM API Key

    Bitwarden Server prior to v2026.4.1 does not require master-password re-authentication when retrieving or rotating an organization's SCIM API key, allowing an authenticated user with SCIM management privileges to obtain the key using only a valid session.

    bitwarden server
  • High 8.0
    CVE-2026-43639

    Bitwarden Server < 2026.4.0 Missing Authorization via Provider Clients

    Bitwarden Server prior to v2026.4.0 contains a missing authorization vulnerability that allows a provider service user to add an arbitrary organization to their provider via `POST /providers/{providerId}/clients/existing`, resulting in takeover of the target …

    bitwarden server
  • Medium 5.4
    CVE-2026-43638

    Bitwarden Server < 2026.4.1 Missing Authorization via Organization Cipher Import

    Bitwarden Server prior to v2026.4.1 contains a missing authorization vulnerability that allows any authenticated user to write ciphers into an arbitrary organization via `POST /ciphers/import-organization` by submitting an empty `collections` array, which cau…

    bitwarden server

Revision history

  1. #1

    Initiale Fassung

References