Skip to content
OpenAdvisories
High WID-SEC-2026-1600 4 CVEs

Vaultwarden: Mehrere Schwachstellen ermöglichen Erlangen von Benutzerrechten

Published May 19, 2026 · Updated Jul 15, 2026 · Revision 2 · de-DE

Platform: Linux Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Vaultwarden ausnutzen, um Benutzerrechte zu erlangen und Informationen offenzulegen.

Product

Vaultwarden ist eine alternative Implementierung der Server API des Bitwarden Passwort-Managers.

Vulnerabilities 4

  • High 8.3
    CVE-2026-47158

    Vaultwarden: CSRF in SSO Authorization Flow

    Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.36.0, Vaultwarden's SSO authorization flow did not bind the OAuth state parameter accepted by /connect/authorize to the initiating browser session, allowed attacker-controlled PKCE param…

    dani-garcia vaultwarden
  • High 7.7
    CVE-2026-47164

    Vaultwarden: SSO Email Auto-Link Can Bind an Existing Local Account to an Attacker-Controlled IdP Identity

    Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.36.0, Vaultwarden's SSO login flow checked the IdP email_verified claim only for new-user creation and not when SSO_SIGNUPS_MATCH_EMAIL=true linked an IdP identity to an existing local a…

    dani-garcia vaultwarden
  • Medium 6.9
    CVE-2026-47159

    Vaultwarden: Authentication Flow Information Disclosure in SSO Discovery Allows Organization Enumeration and Pre-Validation Token Exposure

    Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.36.0, Vaultwarden's SSO discovery and pre-validation flow returned organization-related SSO metadata including organizationIdentifier values for arbitrary email addresses and allowed a v…

    dani-garcia vaultwarden
  • Medium 5.8
    CVE-2026-47160

    Vaultwarden: Server-side request forgery (SSRF) via Icon Endpoint Decimal/Hex/Octal IP Bypass

    Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.36.0, Vaultwarden's /icons/{domain}/icon.png endpoint used src/http_client.rs checks including should_block_address() and post_resolve() that missed decimal, hexadecimal, and octal IP re…

    dani-garcia vaultwarden

Revision history

  1. #2

    Referenz(en) aufgenommen: EUVD-2026-44694, EUVD-2026-44696, EUVD-2026-44693, EUVD-2026-44695

  2. #1

    Initiale Fassung

References