Bitwarden vulnerabilities

Products

• Server 11
• Bitwarden 4

Newest

• bitwarden server Bitwarden Server before 2026.10.1 Authorization Bypass via POST /api/ciphers/create CVE-2026-119414 5.3 MediumOctober 30, 2026
• bitwarden server Bitwarden Server 2025.6.0 < 2025.6.0 Authentication Bypass via SSO Identifier Truncation CVE-2026-101878 7.7 HighSeptember 29, 2026
• bitwarden server Bitwarden Server < 2026.7.2 Audit Log Injection via POST /collect CVE-2026-71959 6.9 MediumAugust 10, 2026
• bitwarden server Bitwarden Server < 2026.6.0 Authorization Bypass via Admin Auth Request CVE-2026-60104 9.3 CriticalJuly 8, 2026
• bitwarden server Bitwarden Server < 2026.5.0 JSON Injection via Webhook Templates CVE-2026-57522 2.3 LowJune 25, 2026
• bitwarden server Bitwarden Server < 2026.5.0 Broken Access Control via PreviewInvoiceController CVE-2026-57521 5.3 MediumJune 25, 2026
• bitwarden server Bitwarden Server < 2026.5.0 Privilege Escalation via Bulk User Remove Endpoint CVE-2026-57520 7.1 HighJune 25, 2026
• bitwarden server Bitwarden Server < 2026.4.1 Authentication Bypass via SCIM API Key CVE-2026-43640 8.6 HighMay 11, 2026
• bitwarden server Bitwarden Server < 2026.4.0 Missing Authorization via Provider Clients CVE-2026-43639 8.9 HighMay 11, 2026
• bitwarden server Bitwarden Server < 2026.4.1 Missing Authorization via Organization Cipher Import CVE-2026-43638 5.3 MediumMay 11, 2026
• bitwarden cli Bitwarden CLI 2026.4.0 from 2026-04-22T21:57Z to 2026-04-22T23:30Z, when obtained from npm, had... CVE-2026-42994 8.8 HighMay 1, 2026
• bitwarden An issue in Bitwarden Bitwarden Desktop v.2023.5.1 allows a local attacker to obtain sensitive... CVE-2023-38840 Public exploit 5.5 MediumAugust 15, 2023
• bitwarden Bitwarden Desktop v1.20.0 and above stores the biometric key in plaintext which allows a local... CVE-2023-27706 7.1 HighJune 9, 2023
• bitwarden ** DISPUTED ** Bitwarden through 2023.2.1 offers password auto-fill when the second-level domain... CVE-2023-27974 Disputed 7.5 HighMarch 8, 2023
• bitwarden ** DISPUTED ** Bitwarden through 2023.2.1 offers password auto-fill within a cross-domain IFRAME... CVE-2018-25081 Disputed 7.5 HighMarch 8, 2023
• bitwarden server Bitwarden Server 1.35.1 allows SSRF because it does not consider certain IPv6 addresses (ones... CVE-2020-15879 7.5 HighJuly 21, 2020
• bitwarden server The Bitwarden server through 1.32.0 has a potentially unwanted KDF. CVE-2019-19766 7.5 HighDecember 12, 2019