EUVD-2026-39543
GHSA-w6hw-45mp-qr7v
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Requires authenticated membership (PR:L) and admin-configured event integration with user-controlled token (AC:H); integrity impact crosses scope to downstream webhook/SIEM consumers (S:C).
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Bitwarden Server before 2026.5.0 contains a JSON injection vulnerability in IntegrationTemplateProcessor.ReplaceTokens(), which substitutes user-controlled values into event-integration templates without JSON encoding. When an organization has configured an event integration whose template references a user-controlled token (such as #ActingUserName
or #UserName#, populated from a member's display name), an authenticated member can set their display name to JSON metacharacters and inject arbitrary key-value pairs into the rendered payloads delivered to webhook, SIEM, Slack, Teams, or Datadog endpoints, making injected fields indistinguishable from legitimate template output.
AnalysisAI
JSON injection in Bitwarden Server's IntegrationTemplateProcessor.ReplaceTokens() allows authenticated organization members to corrupt event-integration payloads delivered to webhook, SIEM, Slack, Teams, or Datadog endpoints. Any organization running Bitwarden Server prior to 2026.5.0 that has configured event integrations referencing user-controlled tokens such as #ActingUserName
or #UserName
is exposed. A public proof-of-concept exists per VulnCheck and independent researcher disclosure; exploitation is constrained by authentication and specific integration-configuration prerequisites, reflected in the low CVSS 4.0 score of 2.3.
Technical ContextAI
The vulnerability resides in IntegrationTemplateProcessor.ReplaceTokens() within the Bitwarden Server codebase (CPE: cpe:2.3:a:bitwarden:server:*:*:*:*:*:*:*:*). Event-integration templates perform string substitution of user-controlled tokens - specifically display-name tokens like #ActingUserName
and #UserName
- into JSON payloads without applying JSON encoding or escaping metacharacters. This is a CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component - Injection) flaw: because the output format is JSON, omitting encoding allows a user-supplied string to break out of its intended string context and introduce arbitrary key-value pairs. The rendered payloads are then delivered externally to webhooks, SIEMs, Slack, Teams, and Datadog, meaning injected fields propagate to downstream consumers where they may influence alerting logic, log correlation, or automated response workflows and appear indistinguishable from legitimate template output.
RemediationAI
Upgrade Bitwarden Server to version 2026.5.0 or later, which contains the fix committed in a26afd18130ef985ede5c97d277820d045185a28 and documented in PR #7593 (https://github.com/bitwarden/server/pull/7593) and the release page (https://github.com/bitwarden/server/releases/tag/v2026.5.0). Organizations unable to patch immediately can reduce exposure by auditing all configured event integrations and removing or rewriting templates that reference user-controlled tokens such as #ActingUserName
or #UserName#; substituting only system-generated or admin-controlled values eliminates the injection surface at the cost of reduced event context in downstream payloads. A further compensating control is restricting organization membership to trusted internal users, as exploitation requires an authenticated member account, though this limits collaboration. Downstream webhook and SIEM consumers should treat all ingested Bitwarden event payloads as potentially tainted until the server is patched, and schema validation on inbound webhook data can prevent injected fields from influencing automated logic.
Traccar Traccar Server version 4.0 and earlier contains a CWE-94: Improper Control of Generation of Code ('Code Injectio
Account takeover in self-hosted Bitwarden Server before 2026.6.0 lets a low-privileged organization member steal any oth
Provider service users in Bitwarden Server Cloud can hijack arbitrary organizations via unauthorized API endpoint access
NoMachine Server is affected by Integer Overflow. Rated high severity (CVSS 8.8), this vulnerability is low attack compl
NoMachine Server is affected by Buffer Overflow. Rated high severity (CVSS 8.8), this vulnerability is low attack comple
Authentication bypass in Bitwarden Server versions prior to 2026.4.1 allows authenticated users with SCIM management pri
JetAudio jetCast Server 2.0 contains a stack-based buffer overflow vulnerability in the Log Directory configuration fiel
A broken authentication vulnerability in 4D SAS 4D Server software v17, v18, v19 R7, and earlier allows attackers to sen
An information disclosure vulnerability in 4D SAS 4D Server Application v17, v18, v19 R7 and earlier allows attackers to
Privilege escalation in self-hosted Bitwarden Server before 2026.5.0 lets an authenticated organization member holding a
Audit log integrity across all Bitwarden Server organizations can be undermined by any authenticated user, who may injec
In the webmail component in IceWarp Server 11.3.1.5, there was an XSS vulnerability discovered in the "language" paramet
Same technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today