Bitwarden Server CVE-2026-43640

Exploitation requires the attacker to hold an authenticated Bitwarden Server user account with SCIM management privileges within the target organization. SCIM management role is typically granted only to IT administrators or users responsible for identity provider integration in enterprise deployments. The vulnerability affects organizations that have enabled SCIM provisioning features (not default for all installations). Attackers must have network access to the Bitwarden Server instance (AV:N) but do not need master password knowledge or additional authentication beyond their existing session. Organizations not using SCIM provisioning, individual Bitwarden accounts, and family plan vaults are inherently not vulnerable regardless of version. The attack does not work against unauthenticated remote attackers or users without pre-existing SCIM management delegation.

The 8.6 CVSS score accurately reflects high risk for organizations using Bitwarden Server's SCIM provisioning features. Key risk indicators align: CVSS vector shows network attack vector (AV:N), low complexity (AC:L), and low privileges required (PR:L), meaning any authenticated user with SCIM management role can exploit this without technical barriers. Publicly available exploit code (per VulnCheck advisory and researcher writeup at sanjokkarki.com.np) significantly lowers exploitation barrier. However, this is NOT a widespread remote unauthentication vulnerability - exploitation requires pre-existing SCIM management privileges, which are typically granted only to IT administrators in enterprise deployments. EPSS and KEV data not provided, but given the public POC and enterprise target audience, organizations using SCIM should prioritize patching. The high confidentiality impact (VC:H) is accurate: stolen SCIM keys enable silent user manipulation. High integrity impact (VI:H) reflects potential for unauthorized provisioning changes. Real-world risk is concentrated in enterprise Bitwarden deployments with SCIM enabled - self-hosted instances without SCIM or individual/family plans are unaffected. Patch available since v2026.4.1 release (GitHub tag confirmed), making this a remediation priority for affected organizations rather than an emergency for all Bitwarden users.

An authenticated Bitwarden user with SCIM management privileges (typically delegated IT administrator role) accesses the organization settings panel using their valid session token. Instead of performing legitimate SCIM configuration, the attacker navigates to the SCIM API key management endpoint and retrieves the organization's SCIM API key without being prompted for master password re-authentication. Using the stolen SCIM key, the attacker programmatically creates unauthorized administrator accounts, escalates privileges of compromised accounts, or exfiltrates organizational user data through SCIM provisioning APIs. Public POC demonstrating the bypass is available at https://sanjokkarki.com.np/blog/bitwarden-scim-key-bypass, lowering technical barrier for exploitation.