EUVD-2026-44695Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
AC:H because exploitation needs non-default SSO_SIGNUPS_MATCH_EMAIL=true plus control of a trusted IdP identity; PR:N as no Vaultwarden auth is needed; account takeover gives C:H/I:H, no availability impact so A:N.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.36.0, Vaultwarden's SSO login flow checked the IdP email_verified claim only for new-user creation and not when SSO_SIGNUPS_MATCH_EMAIL=true linked an IdP identity to an existing local account, allowing an attacker-controlled IdP identity asserting a victim email address to bind to and authenticate as that account. This issue is fixed in version 1.36.0.
AnalysisAI
Authentication bypass (account takeover) in Vaultwarden before 1.36.0 allows an attacker who controls a federated identity provider identity to log in as an arbitrary local user by asserting that user's email address. The flaw exists because the SSO login flow validated the IdP 'email_verified' claim only during new-user creation, but skipped it when SSO_SIGNUPS_MATCH_EMAIL=true linked an incoming IdP identity to a pre-existing local account. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the fix is confirmed in release 1.36.0.
Technical ContextAI
Vaultwarden is a lightweight, Rust-based, self-hosted server implementing the Bitwarden API, commonly run by individuals, homelabs, and small organizations to manage password vaults. The defect is in its OpenID Connect / SSO integration (src/api/identity.rs, _sso_login). When SSO_SIGNUPS_MATCH_EMAIL is enabled, Vaultwarden matches an incoming SSO identity to an existing local (non-SSO) user by email address. The 'email_verified' OIDC claim - which signals whether the IdP has actually proven the user owns that email - was enforced only on the new-account creation path and not on this account-linking path, mapping cleanly to CWE-284 (Improper Access Control): a security decision (identity binding) was made without enforcing the control (email verification) that makes it trustworthy. The patch (PR #7163, commit d297e27) adds explicit handling so that an unknown or 'false' email_verified status on an existing user aborts login (unless SSO_ALLOW_UNKNOWN_EMAIL_VERIFICATION is set), plus a new sso_auth binding_hash column to strengthen identity binding.
RemediationAI
Vendor-released patch: 1.36.0 - upgrade all Vaultwarden instances to 1.36.0 or later, which enforces the email_verified claim on the SSO account-linking path (advisory GHSA-6x5c-84vm-5j56, PR https://github.com/dani-garcia/vaultwarden/pull/7163). If you cannot patch immediately, the most direct compensating control is to set SSO_SIGNUPS_MATCH_EMAIL=false, which disables email-based linking of IdP identities to existing local accounts and closes the bypass - the trade-off is that legitimate users who expect to link their existing local account via SSO will no longer be auto-matched and must be provisioned or linked another way. Alternatively, disable SSO entirely until patched, and after upgrading, do NOT set SSO_ALLOW_UNKNOWN_EMAIL_VERIFICATION unless you fully trust your IdP to only issue verified emails, since that setting re-permits linking when email_verified is unknown. Ensure your IdP is configured to populate a truthful email_verified claim.
More in Vaultwarden
View allTwo-factor authentication bypass in Vaultwarden 1.34.3 and earlier allows authenticated attackers to circumvent 2FA prot
Cross-organization authorization bypass in Vaultwarden (the Rust-based, self-hosted Bitwarden-compatible server) prior t
Vaultwarden versions prior to 1.35.4 fail to properly enforce collection management permissions, allowing authenticated
Vaultwarden versions before 1.35.4 contain a privilege escalation vulnerability that allows authenticated Manager-level
Session hijacking via a broken SSO/OAuth authorization flow affects Vaultwarden (the Rust-based Bitwarden-compatible ser
Improper authorization in Vaultwarden (self-hosted Bitwarden-compatible server) before 1.35.5 lets an authenticated user
vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs. Rated high sev
Brute-force protection bypass in Vaultwarden (the Rust Bitwarden-compatible server) before 1.35.4 lets unauthenticated r
Vaultwarden's SSO discovery endpoint exposed real organization SSO metadata - including organizationIdentifier values -
Insufficient session expiration in Vaultwarden prior to 1.35.5 allows an attacker holding a previously obtained refresh
Vaultwarden versions prior to 1.35.3 allow authenticated organization members to bypass collection-level access controls
Server-side request forgery (SSRF) in Vaultwarden's icon fetching endpoint allows blind internal network and port discov
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today