EUVD-2026-88605
GHSA-2fcc-4gv4-mvr7
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network SSO endpoint (AV:N); AC:H because attacker must know and prefix the victim's exact 50-char identifier; PR:L for a provisionable IdP identity; full victim account takeover gives C:H/I:H, no availability impact (A:N).
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
4DescriptionCVE.org
Bitwarden Server 2025.6.0 before 2026.5.0 declares the @ExternalId parameter of the User_ReadBySsoUserOrganizationIdExternalId stored procedure as NVARCHAR(50) while the column it queries stores NVARCHAR(300), silently truncating the SSO login identifier on SQL Server deployments and allowing a user whose identity-provider identifier begins with another organization member's full 50-character identifier to authenticate as that member and obtain a victim-scoped access token.
AnalysisAI
Authentication bypass in self-hosted Bitwarden Server versions 2025.6.0 through 2026.5.0 backed by Microsoft SQL Server allows a user with a provisionable SSO identity to obtain a victim-scoped access token. The stored procedure User_ReadBySsoUserOrganizationIdExternalId declares its @ExternalId parameter as NVARCHAR(50) while the column it queries stores NVARCHAR(300), so an identity-provider ExternalId whose value begins with a victim organization member's full 50-character identifier is silently truncated and matches that member's record during SSO login. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a self-hosted Bitwarden Server deployment backed by Microsoft SQL Server (the truncation manifests via the SQL Server NVARCHAR(50) stored-procedure parameter) with organization SSO login enabled. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine authentication-bypass / account-takeover flaw (CWE-303) mislabeled in the input as 'Information Disclosure' - the outcome is a victim-scoped access token, i.e. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Bitwarden Server to version 2026.5.0 or later, which is the vendor-released fix; the underlying change is commit 27ae3d5455f723975fac03819eaeba8710666bc4 (pull request https://github.com/bitwarden/server/pull/7501), aligned with the v2026.5.0 release notes and the vendor advisory at https://www.vulncheck.com/advisories/bitwarden-server-authentication-bypass-via-sso-identifier-truncation. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all self-hosted Bitwarden Server instances, identify any running versions 2025.6.0 through 2026.5.0 on Microsoft SQL Server with organization SSO login enabled, and disable SSO login or restrict access to those deployments until patching is complete. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Account takeover in self-hosted Bitwarden Server before 2026.6.0 lets a low-privileged organization member steal any oth
Provider service users in Bitwarden Server Cloud can hijack arbitrary organizations via unauthorized API endpoint access
Authentication bypass in Bitwarden Server versions prior to 2026.4.1 allows authenticated users with SCIM management pri
Bitwarden through 2023.2.1 offers password auto-fill when the second-level domain matches, e.g., a password stored for a
Privilege escalation in self-hosted Bitwarden Server before 2026.5.0 lets an authenticated organization member holding a
Bitwarden Windows desktop application versions prior to v2023.4.0 store biometric keys in Windows Credential Manager, ac
Audit log integrity across all Bitwarden Server organizations can be undermined by any authenticated user, who may injec
Broken access control in Bitwarden Server before 2026.5.0 exposes organization billing data to any authenticated user vi
Bitwarden Server prior to v2026.4.1 allows any authenticated user to write ciphers (encrypted credentials) into arbitrar
Malicious code injection in Bitwarden CLI 2026.4.0 distributed via npm for 90 minutes on April 22, 2026, enables remote
Bitwarden Server 1.35.1 allows SSRF because it does not consider certain IPv6 addresses (ones beginning with fc, fd, fe,
The Bitwarden server through 1.32.0 has a potentially unwanted KDF. Rated high severity (CVSS 7.5), this vulnerability i
Vendor StatusVendor
SUSE
Severity: ImportantShare
External POC / Exploit Code
Leaving vuln.today