Bitwarden Server
9 CVEs affecting Bitwarden Server. Latest disclosed: 2026-07-08. Critical: 0, High: 6.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-60104 | High | 8.7 | 2026-07-08 | Bitwarden Server before 2026.6.0 does not verify that the email in a POST /auth-requests/admin-request body belongs to the authenticated caller, allowing a low… |
CVE-2026-43640 | High | 8.1 | 2026-05-11 | Bitwarden Server prior to v2026.4.1 does not require master-password re-authentication when retrieving or rotating an organization's SCIM API key, allowing an… |
CVE-2026-43639 | High | 8.0 | 2026-05-11 | Bitwarden Server prior to v2026.4.0 contains a missing authorization vulnerability that allows a provider service user to add an arbitrary organization to thei… |
CVE-2020-15879 | High | 7.5 | 2020-07-21 | Bitwarden Server 1.35.1 allows SSRF because it does not consider certain IPv6 addresses (ones beginning with fc, fd, fe, or ff, and the :: address) and certain… |
CVE-2019-19766 | High | 7.5 | 2019-12-12 | The Bitwarden server through 1.32.0 has a potentially unwanted KDF. |
CVE-2026-57520 | High | 7.1 | 2026-06-25 | Bitwarden Server before 2026.5.0 contains a privilege escalation vulnerability that allows authenticated Custom users with ManageUsers permission to remove Adm… |
CVE-2026-43638 | Medium | 5.4 | 2026-05-11 | Bitwarden Server prior to v2026.4.1 contains a missing authorization vulnerability that allows any authenticated user to write ciphers into an arbitrary organi… |
CVE-2026-57521 | Medium | 4.3 | 2026-06-25 | Bitwarden Server before 2026.5.0 contains a broken access control vulnerability that allows any authenticated user to access arbitrary organization billing dat… |
CVE-2026-57522 | Low | 3.5 | 2026-06-25 | Bitwarden Server before 2026.5.0 contains a JSON injection vulnerability in IntegrationTemplateProcessor.ReplaceTokens(), which substitutes user-controlled val… |