What is CVE-2026-47164?

CVE-2026-47164 is a high-severity vulnerability in Dani-garcia Vaultwarden, classified under Improper Access Control. CVSS score: 7.7/10. Published 2026-07-15.

How severe is CVE-2026-47164?

High severity. CVSS v3 base score is 7.7 out of 10.

Vulnerability in Dani-garcia Vaultwarden

CVE-2026-47164

Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.36.0, Vaultwarden's SSO login flow checked the IdP email_verified claim only for new-user creation and not when SSO_SIGNUPS_MATCH_EMAIL=true linked an IdP identity to…

CVSS v3 metric

CVSS v3 base score 7.7 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L.

Affected products

Dani-garcia Vaultwarden — versions < 1.36.0

Weakness classification (CWE)

CWE-284 — Improper Access Control

References

security-advisories@github.com (x_refsource_CONFIRM)
security-advisories@github.com (x_refsource_MISC)
security-advisories@github.com (x_refsource_MISC)
security-advisories@github.com (x_refsource_MISC)

Frequently asked questions

What is CVE-2026-47164?: CVE-2026-47164 is a high-severity vulnerability in Dani-garcia Vaultwarden, classified under Improper Access Control. CVSS score: 7.7/10. Published 2026-07-15.
How severe is CVE-2026-47164?: High severity. CVSS v3 base score is 7.7 out of 10.