EUVD-2026-44693Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H
Network CSRF against the SSO flow needs no attacker auth (PR:N) but the victim must complete IdP login (UI:R); full session takeover yields high confidentiality, integrity and availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.36.0, Vaultwarden's SSO authorization flow did not bind the OAuth state parameter accepted by /connect/authorize to the initiating browser session, allowed attacker-controlled PKCE parameters, and left SsoAuth records intact after failed token exchange, allowing an unauthenticated attacker to induce IdP authentication and redeem tokens for a fully authenticated session. This issue is fixed in version 1.36.0.
AnalysisAI
Session hijacking via a broken SSO/OAuth authorization flow affects Vaultwarden (the Rust-based Bitwarden-compatible server) prior to 1.36.0, where the /connect/authorize endpoint fails to bind the OAuth state parameter to the initiating browser session, accepts attacker-controlled PKCE parameters, and leaves SsoAuth records intact after a failed token exchange. By tricking a victim into completing IdP authentication (UI:R), an unauthenticated attacker can redeem the resulting tokens for a fully authenticated session and take over the victim's vault. Rated CVSS 8.3 (CWE-352) with no public exploit identified at time of analysis and no CISA KEV listing.
Technical ContextAI
Vaultwarden is a lightweight, self-hosted, Bitwarden-compatible password manager server written in Rust (CPE cpe:2.3:a:dani-garcia:vaultwarden). The flaw lives in its optional SSO/OpenID Connect login path (src/api/identity.rs, the _sso_login / oidcsignin handlers) which implements the OAuth 2.0 authorization-code flow with PKCE. The root cause is CWE-352 (Cross-Site Request Forgery): the OAuth 'state' value returned to /connect/authorize was never cryptographically bound to the browser session that started the flow, PKCE code-challenge/verifier parameters could be supplied by the attacker rather than generated per-session, and stale SsoAuth database rows survived failed token exchanges - collectively defeating the anti-CSRF and code-injection protections that OAuth state and PKCE are meant to provide. The fix (PR #7163, commit d297e274) adds a binding_hash column to the sso_auth table across the MySQL/PostgreSQL/SQLite migrations and a VW_SSO_BINDING (SameSite) cookie to tie the authorization flow to the originating browser, plus stricter SSO email-verification checks.
RemediationAI
Vendor-released patch: upgrade to Vaultwarden 1.36.0 or later, which binds the SSO flow to the initiating browser via a VW_SSO_BINDING cookie and a new sso_auth.binding_hash column and applies the required database migration automatically on startup - see the advisory at https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-pfp2-jhgq-6hg5, the fix in https://github.com/dani-garcia/vaultwarden/pull/7163 (commit d297e274a35dccd0f5d935e9d5934e0f7e9c0a87), and the release notes at https://github.com/dani-garcia/vaultwarden/releases/tag/1.36.0. If you cannot upgrade immediately, the most effective compensating control is to disable the SSO/OIDC login integration and fall back to master-password/local authentication, which fully removes the vulnerable code path at the cost of losing single sign-on; alternatively, restrict network exposure of the server and the /connect/authorize endpoint to trusted users behind a reverse proxy or VPN to shrink the pool of attackers who can initiate a forged flow. After upgrading, consider invalidating existing sessions and reviewing SSO login events, since stale SsoAuth records were previously not cleaned up.
More in Vaultwarden
View allTwo-factor authentication bypass in Vaultwarden 1.34.3 and earlier allows authenticated attackers to circumvent 2FA prot
Cross-organization authorization bypass in Vaultwarden (the Rust-based, self-hosted Bitwarden-compatible server) prior t
Vaultwarden versions prior to 1.35.4 fail to properly enforce collection management permissions, allowing authenticated
Vaultwarden versions before 1.35.4 contain a privilege escalation vulnerability that allows authenticated Manager-level
Improper authorization in Vaultwarden (self-hosted Bitwarden-compatible server) before 1.35.5 lets an authenticated user
Authentication bypass (account takeover) in Vaultwarden before 1.36.0 allows an attacker who controls a federated identi
vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs. Rated high sev
Brute-force protection bypass in Vaultwarden (the Rust Bitwarden-compatible server) before 1.35.4 lets unauthenticated r
Vaultwarden's SSO discovery endpoint exposed real organization SSO metadata - including organizationIdentifier values -
Insufficient session expiration in Vaultwarden prior to 1.35.5 allows an attacker holding a previously obtained refresh
Vaultwarden versions prior to 1.35.3 allow authenticated organization members to bypass collection-level access controls
Server-side request forgery (SSRF) in Vaultwarden's icon fetching endpoint allows blind internal network and port discov
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today