Bitwarden CVE-2023-27706

Account takeover in self-hosted Bitwarden Server before 2026.6.0 lets a low-privileged organization member steal any oth

Provider service users in Bitwarden Server Cloud can hijack arbitrary organizations via unauthorized API endpoint access

Authentication bypass in Bitwarden Server versions prior to 2026.4.1 allows authenticated users with SCIM management pri

Bitwarden through 2023.2.1 offers password auto-fill when the second-level domain matches, e.g., a password stored for a

Privilege escalation in self-hosted Bitwarden Server before 2026.5.0 lets an authenticated organization member holding a

Audit log integrity across all Bitwarden Server organizations can be undermined by any authenticated user, who may injec

Broken access control in Bitwarden Server before 2026.5.0 exposes organization billing data to any authenticated user vi

Bitwarden Server prior to v2026.4.1 allows any authenticated user to write ciphers (encrypted credentials) into arbitrar

Malicious code injection in Bitwarden CLI 2026.4.0 distributed via npm for 90 minutes on April 22, 2026, enables remote

Bitwarden Server 1.35.1 allows SSRF because it does not consider certain IPv6 addresses (ones beginning with fc, fd, fe,

The Bitwarden server through 1.32.0 has a potentially unwanted KDF. Rated high severity (CVSS 7.5), this vulnerability i

JSON injection in Bitwarden Server's IntegrationTemplateProcessor.ReplaceTokens() allows authenticated organization memb