Description
Bitwarden Server 2025.6.0 before 2026.5.0 declares the @ExternalId parameter of the User_ReadBySsoUserOrganizationIdExternalId stored procedure as NVARCHAR(50) while the column it queries stores NVARCHAR(300), silently truncating the SSO login identifier on SQL Server deployments and allowing a user whose identity-provider identifier begins with another organization member's full 50-character identifier to authenticate as that member and obtain a victim-scoped access token.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| bitwarden | bitwarden server | 2025.6.0 – < 2026.5.0 | 2026.5.0 |
Advisories 1
- WID-SEC-2026-3610 Bitwarden: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen BSI CERT-Bund (WID) · Sep 28, 2026
References
- Researcher Blog technical-description exploit
- bitwarden server 2026.5.0 Release Notes release-notes
- Pull Request issue-tracking patch
- Patch Commit patch
- https://www.vulncheck.com/advisories/bitwarden-server-authentication-bypass-via-sso-identifier-truncation third-party-advisory