By vendor

Bitwarden vulnerabilities

Known CVEs affecting Bitwarden products, prioritized by severity, with SEC.co remediation and detection guidance.

4 published vulnerabilities

• CVE-2026-60104HIGH 8.7

  Bitwarden Server contains an authentication bypass vulnerability that allows a low-privileged organization member to impersonate another user and steal their vault encryption key. The flaw stems from insufficient validation when creating a Trusted Device Encryption authentication request—the system fails to confirm that the email address in the request belongs to the person making it. An attacker can craft a request targeting a victim, bind it to their own public key, and once a legitimate user approves it, the attacker can retrieve the victim's vault key and gain full account access from an unauthenticated endpoint. This is particularly dangerous because it requires only basic organizational membership and minimal user interaction.

• CVE-2026-57520HIGH 7.1

  Bitwarden Server versions before 2026.5.0 contain a privilege escalation flaw that allows authenticated users with limited ManageUsers permissions to remove administrator accounts from an organization. An attacker with a Custom user role could exploit a gap in the bulk user-removal endpoint to delete Admin accounts that would normally be protected, potentially compromising organizational access controls and administrative oversight.

• CVE-2026-57521MEDIUM 4.3

  Bitwarden Server versions before 2026.5.0 contain a flaw in how they control access to billing information. Any user with a valid login can retrieve billing and invoice details from any organization in the system—not just ones they belong to—by simply providing a different organization's ID to the preview invoice feature. This allows unauthorized access to sensitive financial data including Stripe tax calculations, subscription status, and customer information.

• CVE-2026-57522LOW 3.5

  Bitwarden Server versions before 2026.5.0 allow authenticated users to inject malicious JSON data into event integration outputs by manipulating their own display name. When an organization has configured integrations (such as webhooks to SIEM, Slack, Teams, or Datadog) that include user information in the payload, an attacker can set their display name to contain JSON special characters. This causes the server to render those characters into the integration payload without properly escaping them, allowing the attacker to insert fake data fields that appear legitimate to downstream systems. The vulnerability requires an authenticated account and knowledge that event integrations are in use, limiting its scope to internal threat actors or compromised user accounts.