Bitwarden Server vulnerabilities

• bitwarden server Bitwarden Server before 2026.10.1 Authorization Bypass via POST /api/ciphers/create CVE-2026-119414 5.3 MediumOctober 30, 2026
• bitwarden server Bitwarden Server 2025.6.0 < 2025.6.0 Authentication Bypass via SSO Identifier Truncation CVE-2026-101878 7.7 HighSeptember 29, 2026
• bitwarden server Bitwarden Server < 2026.7.2 Audit Log Injection via POST /collect CVE-2026-71959 6.9 MediumAugust 10, 2026
• bitwarden server Bitwarden Server < 2026.6.0 Authorization Bypass via Admin Auth Request CVE-2026-60104 9.3 CriticalJuly 8, 2026
• bitwarden server Bitwarden Server < 2026.5.0 JSON Injection via Webhook Templates CVE-2026-57522 2.3 LowJune 25, 2026
• bitwarden server Bitwarden Server < 2026.5.0 Broken Access Control via PreviewInvoiceController CVE-2026-57521 5.3 MediumJune 25, 2026
• bitwarden server Bitwarden Server < 2026.5.0 Privilege Escalation via Bulk User Remove Endpoint CVE-2026-57520 7.1 HighJune 25, 2026
• bitwarden server Bitwarden Server < 2026.4.1 Authentication Bypass via SCIM API Key CVE-2026-43640 8.6 HighMay 11, 2026
• bitwarden server Bitwarden Server < 2026.4.0 Missing Authorization via Provider Clients CVE-2026-43639 8.9 HighMay 11, 2026
• bitwarden server Bitwarden Server < 2026.4.1 Missing Authorization via Organization Cipher Import CVE-2026-43638 5.3 MediumMay 11, 2026
• bitwarden server Bitwarden Server 1.35.1 allows SSRF because it does not consider certain IPv6 addresses (ones... CVE-2020-15879 7.5 HighJuly 21, 2020
• bitwarden server The Bitwarden server through 1.32.0 has a potentially unwanted KDF. CVE-2019-19766 7.5 HighDecember 12, 2019