Vaultwarden CVE-2026-47158

Exploitation requires that the target Vaultwarden instance has the SSO/OIDC login integration enabled and configured against an identity provider - this is an opt-in, non-default feature and the primary limiting factor. The attacker must also induce a victim to complete IdP authentication (UI:R in the CVSS vector), so successful attacks depend on social engineering or on a legitimate user being tricked into finishing a login the attacker started. The specific technical preconditions are the pre-1.36.0 behaviors named in the description: /connect/authorize accepting an OAuth state not bound to the initiating browser session, acceptance of attacker-controlled PKCE parameters, and SsoAuth records left intact after a failed token exchange. The attacker themselves needs no prior authentication (PR:N) and only network reachability to the server's authorization endpoint.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H, score 8.3) describes a network-reachable, low-complexity, unauthenticated attack that requires user interaction - consistent with a CSRF/OAuth-binding weakness where the victim must be lured into completing an IdP login. Impact is high to integrity and availability (full account/vault takeover) with lower confidentiality sub-impact as scored. No EPSS score, no CISA KEV entry, and no public POC were provided, so the real-world exploitation signal is currently low despite the high base score; this is a genuinely serious auth-bypass class but one gated by social engineering (UI:R) and by the target actually having SSO/OIDC enabled - a non-default, opt-in Vaultwarden feature. The key caveat is that Vaultwarden SSO is not enabled by default, so the exposed population is a subset of deployments; treat as high priority for any org that has turned on SSO login and lower priority otherwise. No SSVC decision data was supplied.

An attacker initiates an SSO authorization request against a victim's Vaultwarden server using attacker-chosen PKCE parameters and an unbound state value, then lures the victim (e.g., via a crafted link) into completing authentication at the identity provider. Because the state is not tied to the victim's browser session and the SsoAuth record persists, the attacker redeems the resulting authorization code/tokens to obtain a fully authenticated session as the victim. No public POC was provided at time of analysis, and the attack depends on the low-complexity but user-interaction-dependent CSRF pattern reflected in the CVSS vector.