CVE-2026-60104: Bitwarden Server Account Takeover via Trusted Device Encryption Bypass

Technical summary

CVE-2026-60104 is an authorization and cryptographic key disclosure vulnerability in Bitwarden Server versions prior to 2026.6.0. The POST /auth-requests/admin-request endpoint lacks proper email ownership validation, permitting a low-privileged authenticated user to create a Trusted Device Encryption authentication request with a forged email parameter pointing to another organization member. The request is encrypted using the attacker's public key, not the victim's. When the victim approves the request (believing it is legitimate), the encrypted payload becomes readable from an unauthenticated endpoint, allowing the attacker to decrypt and extract the victim's vault key using their private key. The vulnerability combines authorization bypass (CWE-639: Authorization in Settings), insufficient input validation, and insecure cryptographic binding to compromise both confidentiality and integrity of vault data. CVSS 3.1 score is 8.7 (HIGH) with vector AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N, reflecting network exploitability, low complexity, requirement for low-level privileges, user interaction (victim approval), and broad cross-scope impact on confidentiality and integrity.

Business impact

A successful exploitation enables account takeover of any organization member whose approval can be obtained, granting the attacker unrestricted access to that user's encrypted vault, passwords, notes, and sensitive stored credentials. For organizations using Bitwarden for enterprise credential management, this translates to potential lateral movement, unauthorized access to downstream systems, and wholesale compromise of shared credentials. The attack surface is broad: any organization member can be targeted, and the social engineering bar is low—users expect to encounter device enrollment requests. Unlike phishing or credential theft, the victim's password remains intact, making detection and remediation more complex. Forensic investigation becomes difficult as the attacker's actions appear to originate from legitimate device approval workflows.

Affected systems

Bitwarden Server versions before 2026.6.0 are affected. Organizations running self-hosted Bitwarden Server deployments on-premises or in private cloud environments are directly impacted. Users of Bitwarden's cloud-hosted service (Bitwarden.com) are not affected because Bitwarden Inc. has already deployed the fix. The vulnerability is specific to the server-side authentication request handler and does not require any specific OS, architecture, or configuration beyond a vulnerable Bitwarden Server version with organization features enabled.

Exploitability

This vulnerability presents moderate-to-high exploitability in the wild. The attack requires three conditions: (1) the attacker must have a low-privileged account within a Bitwarden organization, (2) the attacker must identify and target a specific victim within the same organization or a known member, and (3) the victim must approve the authentication request. The first condition is easily satisfied in organizations with open enrollment or liberal invitation policies. The second requires basic OSINT or internal knowledge. The third—user approval—is where the social engineering occurs; attackers can use pretexting or simply submit requests to high-value targets, betting on approval rates. The technical exploitation itself is straightforward: craft a request with a victim's email and attacker-controlled key material. No patches or exploit code are needed; standard Bitwarden client tools suffice. No advanced knowledge of cryptographic protocols or system internals is required. The vulnerability is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog as of the source publication date, but the low barrier to exploitation and high business impact suggest urgent patching is warranted regardless of KEV status.

Remediation

Organizations must upgrade Bitwarden Server to version 2026.6.0 or later. For self-hosted deployments, update through the standard deployment mechanism (Docker, systemd, binary, or package manager). Coordinate the upgrade during a maintenance window if necessary, as it may require service restart. For Bitwarden Cloud customers, no action is required; the fix is already in place. No interim workarounds mitigate the vulnerability; patching is the only remediation. Post-patch, review authentication request logs and device approval histories for suspicious patterns or unusual approvals from low-privileged accounts. Consider implementing organization policies that restrict who can approve device enrollment requests or require additional verification steps (e.g., email confirmation from the victim).

Patch guidance

Apply Bitwarden Server 2026.6.0 or any later stable release. Verify the patch through the official Bitwarden release notes and announcements on bitwarden.com or the project's GitHub repository. Self-hosted administrators should test the upgrade in a non-production environment first to confirm compatibility with existing integrations, SSO configurations, and backup/restore workflows. Cloud customers need not take action. After patching, confirm the server version reported in the admin panel matches the deployed version. No data migration or configuration changes are required; the fix is applied at the authentication request validation layer.

Detection guidance

Monitor for anomalous authentication request patterns: (1) requests with mismatched email and submitter (requires logging of request source and claimed email), (2) approvals from low-privileged accounts of requests targeting high-privilege or admin users, (3) device enrollments followed immediately by vault access from a new or unusual IP address, and (4) clusters of approval requests to the same user within a short window. Enable detailed audit logging in Bitwarden if available. Examine the auth-requests endpoint access logs for unauthenticated reads of request data (which should normally be rare). If your Bitwarden instance supports it, query the database directly for authentication requests where the requester's user_id does not match the user_id of the email owner. Incident response teams should review device approval workflows and credential access logs for any accounts that may have been compromised via this vector.

Why prioritize this

This vulnerability should be prioritized for immediate patching despite the lack of KEV status. The combination of high CVSS score (8.7), low attack complexity, broad target surface (any org member), and minimal attacker prerequisites (low privilege, basic social engineering) makes it a prime candidate for exploitation in targeted and opportunistic attacks. Account takeover of vault credentials is among the highest-impact security events an organization can experience. The vector (network, low privilege, user interaction) is particularly dangerous in remote-work environments where device enrollment requests are normalized. Organizations with large, decentralized Bitwarden deployments should patch urgently within 24–48 hours of validation; smaller deployments should target completion within a week.

Risk score, explained

The risk score of 8.7 (HIGH) reflects the severe consequences of successful exploitation (complete account takeover and credential disclosure) weighted against the realistic exploitability (low privilege, network access, user interaction required, but straightforward to execute). The 'S:C' (Scope Changed) component acknowledges that a compromised vault can be leveraged to access other systems and accounts beyond Bitwarden itself, amplifying business impact. The lack of availability impact (A:N) prevents a maximum score, but confidentiality and integrity are fully compromised. For enterprise security teams, this score translates to material risk and justifies emergency patching.

Frequently asked questions