Which versions of Bitwarden Server are affected by CVE-2026-43640?

Bitwarden Server versions prior to 2026.4.1 contain an authentication bypass affecting SCIM API key management that allows authenticated users with SCIM privileges to retrieve or rotate organization…. A patch is available.

Is there a public PoC exploit available for CVE-2026-43640?

Yes, a public proof-of-concept exploit is available for CVE-2026-43640. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-43640?

Within 24 hours: Inventory all Bitwarden Server deployments and identify current versions; disable or restrict SCIM provisioning integrations if version <2026.4.1 is confirmed. Within 7 days: Apply vendor-released patch v2026.4.1 to all affected Bitwarden Server instances and validate successful deployment. Within 30 days: Conduct audit of SCIM API key rotation history and user account provisioning logs for any unauthorized changes during vulnerable period; reset SCIM API keys post-patch as precautionary measure.

Bitwarden Server CVE-2026-43640

Q: What is the CVSS score of CVE-2026-43640?

CVE-2026-43640 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-29171 HIGH

Incorrect Implementation of Authentication Algorithm (CWE-303)

2026-05-11 VulnCheck

GHSA-6736-x63f-c628

Information Disclosure Server

8.6

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulnCheck) · only source for this CVE.

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

May 11, 2026 - 18:45 vuln.today

Analysis Generated

May 11, 2026 - 18:45 vuln.today

CVSS changed

May 11, 2026 - 18:22 NVD

8.1 (HIGH) 8.6 (HIGH)

CVE Published

May 11, 2026 - 17:14 nvd

HIGH 8.6

DescriptionCVE.org

Bitwarden Server prior to v2026.4.1 does not require master-password re-authentication when retrieving or rotating an organization's SCIM API key, allowing an authenticated user with SCIM management privileges to obtain the key using only a valid session.

AnalysisAI

Authentication bypass in Bitwarden Server versions prior to 2026.4.1 allows authenticated users with SCIM management privileges to retrieve or rotate organization SCIM API keys without master password re-authentication. An attacker with valid session credentials and SCIM management rights can obtain sensitive API keys that enable user provisioning control, potentially leading to unauthorized account creation, modification, or deletion within the organization. Public exploit code exists, and vendor patch v2026.4.1 addresses the issue via GitHub PR #7403.

Technical ContextAI

Bitwarden Server implements System for Cross-domain Identity Management (SCIM) for automated user provisioning in enterprise deployments. SCIM API keys are sensitive credentials that grant programmatic access to user lifecycle operations (create, update, deactivate) within an organization. The vulnerability stems from CWE-303 (Incorrect Implementation of Authentication Algorithm), where the application failed to enforce step-up authentication when accessing or rotating these high-privilege credentials. Normally, sensitive operations like credential retrieval should require master password re-authentication even within an authenticated session, following the principle of least privilege and defense-in-depth. The affected component is the SCIM key management endpoint in Bitwarden Server's organization administration module (cpe:2.3:a:bitwarden:server). The CVSS 4.0 vector indicates network-accessible exploitation with low complexity and low privilege requirements, resulting in high confidentiality and integrity impact to the vulnerable system.

RemediationAI

Upgrade Bitwarden Server to version 2026.4.1 or later, which implements master password re-authentication requirements for SCIM API key operations (patch commit eb251d9bf80724c87b187661783b9354d1784083, merged via PR #7403 at https://github.com/bitwarden/server/pull/7403). Organizations unable to immediately upgrade should implement compensating controls: (1) Rotate all existing SCIM API keys immediately after patching to invalidate any keys that may have been obtained by unauthorized users; (2) Audit SCIM management role assignments to ensure only trusted administrators have access (review organization permission logs for unexpected SCIM key retrievals); (3) If SCIM provisioning is not actively required, temporarily disable the feature via organization settings to eliminate the attack surface until patching is complete; (4) Monitor SCIM API usage logs for anomalous provisioning activity (unusual user creations, bulk modifications, or off-hours access) that may indicate key compromise. Note that disabling SCIM will interrupt automated user provisioning workflows and require manual user management. Release notes available at https://github.com/bitwarden/server/releases/tag/v2026.4.1.