Vulnerabilities

TI-2026-81486 CVE-2026-116678

Server-side request forgery in Vaultwarden icon downloader

HIGH 65

Vaultwarden is a Bitwarden-compatible server written in Rust.

CVSS 3.1MEDIUM 5.8 Network No auth No interaction EPSS 0.0033 Published 2026-10-27 Fixed in 1.37.0 CWE-918

TI-2026-63694 CVE-2026-95814 · GHSA-hm7r-36jx-j25q

Vaultwarden through 1.37.3 Authorization Bypass via Missing Status Check

MEDIUM 40

Vaultwarden through 1.37.3 omits organization membership status validation from three cipher access-restriction queries, allowing revoked and not-yet-confirmed members to retain read, write, delete, and attachment access…

CVSS 4.0HIGH 8.6 Network Low privileges No interaction EPSS 0.00426 Published 2026-09-22 No fix listed CWE-863

TI-2026-34750 CVE-2026-47160

Vaultwarden: Server-side request forgery (SSRF) via Icon Endpoint Decimal/Hex/Octal IP Bypass

MEDIUM 59

Vaultwarden is a Bitwarden-compatible server written in Rust.

CVSS 3.1MEDIUM 5.8 Network No auth No interaction EPSS 0.00291 Published 2026-07-15 Fixed in 1.36.0 CWE-1389

TI-2026-34754 CVE-2026-47164

Vaultwarden: SSO Email Auto-Link Can Bind an Existing Local Account to an Attacker-Controlled IdP Identity

LOW 36

Vaultwarden is a Bitwarden-compatible server written in Rust.

CVSS 3.1HIGH 7.7 Network No auth No interaction EPSS 0.00448 Published 2026-07-15 Fixed in 1.36.0 CWE-284

TI-2026-34749 CVE-2026-47159

Improper authentication in dani-garcia vaultwarden

HIGH 70

Vaultwarden is a Bitwarden-compatible server written in Rust.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00468 Published 2026-07-15 Fixed in 1.36.0 CWE-287

TI-2026-34748 CVE-2026-47158

Vaultwarden: CSRF in SSO Authorization Flow

LOW 36

Vaultwarden is a Bitwarden-compatible server written in Rust.

CVSS 3.1HIGH 8.3 Network No auth User interaction EPSS 0.00252 Published 2026-07-15 Fixed in 1.36.0 CWE-352

TI-2026-31977 CVE-2026-43914

Vaultwarden: Brute-force protection bypass vulnerability

HIGH 81

Vaultwarden is a Bitwarden-compatible server written in Rust.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00288 Published 2026-05-11 Fixed in 1.35.4 CWE-307

TI-2026-31976 CVE-2026-43913

Vaultwarden: Unconfirmed Owner Can Purge Entire Organization Vault

LOW 35

Vaultwarden is a Bitwarden-compatible server written in Rust.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00267 Published 2026-05-11 Fixed in 1.35.5 CWE-863

TI-2026-31975 CVE-2026-43912

Vaultwarden: Cross-Org Group Binding Enables Unauthorized Read And Write Access Into Another Organization

HIGH 73

Vaultwarden is a Bitwarden-compatible server written in Rust.

CVSS 3.1HIGH 8.7 Network High privileges No interaction EPSS 0.00289 Published 2026-05-11 Fixed in 1.35.5 CWE-285

TI-2026-31974 CVE-2026-43911

Vaultwarden: Refresh tokens not invalidated on security stamp rotation

HIGH 70

Vaultwarden is a Bitwarden-compatible server written in Rust.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00216 Published 2026-05-11 Fixed in 1.35.5 CWE-613

TI-2026-25817 CVE-2026-33420

Vaultwarden missing authorization check allows Manager-role users to enumerate all collections

LOW 23

Vaultwarden is a Bitwarden-compatible server written in Rust.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.0017 Published 2026-05-05 Fixed in 1.35.5 CWE-862

TI-2026-24388 CVE-2026-31835

Vaultwarden WebAuthn credential metadata tampered before signature verification

MEDIUM 57

Vaultwarden is a Bitwarden-compatible server written in Rust.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00151 Published 2026-05-05 Fixed in 1.35.5 CWE-345

TI-2026-22242 CVE-2026-27898 · GHSA-w9f8-m526-h7fh

Vaultwarden: Unauthorized Access via Partial Update API on Another User’s Cipher

LOW 24

Vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.0019 Published 2026-03-04 Fixed in 1.35.4 CWE-639

TI-2026-22157 CVE-2026-27803 · GHSA-h4hq-rgvh-wh27

Vaultwarden: Collection Management Operations Allowed Without `manage` Verification for Manager Role

LOW 38

Vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs.

CVSS 3.1HIGH 8.3 Network Low privileges No interaction EPSS 0.00333 Published 2026-03-04 Fixed in 1.35.4 CWE-269

TI-2026-22156 CVE-2026-27802 · GHSA-r32r-j5jq-3w4m

Vaultwarden: Privilege Escalation via Bulk Permission Update to Unauthorized Collections by Manager

LOW 38

Vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs.

CVSS 3.1HIGH 8.3 Network Low privileges No interaction EPSS 0.00333 Published 2026-03-04 Fixed in 1.35.4 CWE-269

TI-2026-22155 CVE-2026-27801 · GHSA-v6pg-v89r-w8wr

Vaultwarden: 2FA Bypass on Protected Actions due to Faulty Rate Limit Enforcement

MEDIUM 60

Vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs.

CVSS 4.0MEDIUM 6.0 Network Low privileges No interaction EPSS 0.00287 Published 2026-03-04 Fixed in 1.35.0 CWE-307

TI-2026-21026 CVE-2026-26012

vaultwarden has Full Cipher Enumeration Ignoring Organization Collection Permissions

LOW 29

vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00467 Published 2026-02-11 Fixed in 1.35.3 CWE-863

TI-2025-18108 CVE-2025-24365

vaultwarden allows escalation of privilege via variable confusion in OrgHeaders trait

HIGH 70

vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.0067 Published 2025-01-27 Fixed in 1.33.0 CWE-284

TI-2025-18107 CVE-2025-24364

vaultwarden allows RCE in the admin panel

HIGH 67

vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00999 Published 2025-01-27 Fixed in 1.33.0 CWE-74

TI-2024-36804 CVE-2024-55226 · GHSA-vprm-27pv-jp3w

Vaultwarden v1.32.5 was discovered to contain an authenticated reflected cross-site…

LOW 25

Vaultwarden v1.32.5 was discovered to contain an authenticated reflected cross-site scripting (XSS) vulnerability via the component /api/core/mod.rs.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.0039 Published 2025-01-09 Fixed in 1.32.5 CWE-79

TI-2024-36803 CVE-2024-55225 · GHSA-x7m9-mv49-fv73

An issue in the component src/api/identity.rs of Vaultwarden prior to v1.32.5 allows…

MEDIUM 50

An issue in the component src/api/identity.rs of Vaultwarden prior to v1.32.5 allows attackers to impersonate users, including Administrators, via a crafted authorization request.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00622 Published 2025-01-09 Fixed in 1.32.5 CWE-276

TI-2024-36802 CVE-2024-55224 · GHSA-g5x8-v2ch-gj2g

An HTML injection vulnerability in Vaultwarden prior to v1.32.5 allows attackers to…

MEDIUM 44

An HTML injection vulnerability in Vaultwarden prior to v1.32.5 allows attackers to execute arbitrary code via injecting a crafted payload into the username field of an e-mail message.

CVSS 3.1CRITICAL 9.6 Network No auth User interaction EPSS 0.00843 Published 2025-01-09 Fixed in 1.32.5 CWE-79

TI-2024-37296 CVE-2024-56335

Privilege escalation allows organization groups to be updated/deleted if their UUID is known in vaultwarden

LOW 33

vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs.

CVSS 3.1HIGH 7.6 Network Low privileges No interaction EPSS 0.0034 Published 2024-12-20 Fixed in 1.32.7 CWE-269

TI-2024-26819 CVE-2024-39926 · GHSA-vfwm-h968-g65h

An issue was discovered in Vaultwarden (formerly Bitwarden_RS) 1.30.3.

LOW 31

An issue was discovered in Vaultwarden (formerly Bitwarden_RS) 1.30.3.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00456 Published 2024-09-13 No fix listed CWE-79

TI-2024-26818 CVE-2024-39925 · GHSA-r89w-9fr4-c7c9

An issue was discovered in Vaultwarden (formerly Bitwarden_RS) 1.30.3.

LOW 36

An issue was discovered in Vaultwarden (formerly Bitwarden_RS) 1.30.3.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00573 Published 2024-09-13 No fix listed CWE-200

Vulnerabilities

Filters