EUVD-2026-42367
GHSA-5g65-rmxf-rgj6
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Any low-privileged org member (PR:L) can exploit remotely with low complexity, but an admin must approve the request (UI:R); stealing another user's key crosses security authority (S:C) with high C/I and no availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
7DescriptionCVE.org
Bitwarden Server before 2026.6.0 does not verify that the email in a POST /auth-requests/admin-request body belongs to the authenticated caller, allowing a low-privileged organization member to obtain another user's vault key and a victim-scoped access token by creating a Trusted Device Encryption authentication request, bound to an attacker-controlled public key, that is readable from an unauthenticated endpoint once approved resulting in disclosure of the victim's vault key and account takeover.
Articles & Coverage 2
AnalysisAI
Account takeover in self-hosted Bitwarden Server before 2026.6.0 lets a low-privileged organization member steal any other member's vault key and a victim-scoped access token. The POST /auth-requests/admin-request handler never verifies that the email in the request body belongs to the authenticated caller (CWE-639), so an attacker can create a Trusted Device Encryption admin-approval request for a victim, bound to an attacker-controlled public key; once approved, the encrypted key material is retrievable from an unauthenticated endpoint. Publicly available exploit code exists (a VulnCheck advisory plus a public write-up), and the CVSS 4.0 base score of 9.3 reflects high confidentiality and integrity impact plus a cross-user scope change.
Technical ContextAI
The affected component is Bitwarden's admin-approval authentication-request flow, part of Trusted Device Encryption (TDE). In TDE a user's symmetric vault key is wrapped to a device or approver public key so it can be delivered without the master password; the admin-request endpoint is intended to let an organization administrator approve a member's new device by re-encrypting that member's key to a key the member controls. The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key): the email field in the AuthRequestCreateRequestModel body is treated as the target identity without confirming it matches the authenticated caller's user id. GitHub PR #7615 fixes this with two guards - the controller now rejects any request whose Type is not AdminApproval, and AuthRequestService.CreateAuthRequestAsync throws when the authenticated user id does not match the resolved target user (while still permitting the intended anonymous flows). The CPE cpe:2.3:a:bitwarden:server:*:*:*:*:*:*:*:* confirms the server application is affected; client apps are not implicated.
RemediationAI
Vendor-released patch: 2026.6.0 - upgrade self-hosted Bitwarden Server to 2026.6.0 or later, which adds server-side validation that the admin-request Type is AdminApproval and that the authenticated caller's user id matches the target account (PR #7615 / commit dcf4c486b2b5bedecc03a48b427243328cc74a9a). Because this is a server-side authorization gap with no client-side toggle, patching is the only complete fix. If an emergency upgrade is not immediately possible, compensating controls are limited but include: instructing organization administrators to stop approving device/admin-approval authentication requests until patched (trade-off: legitimate TDE device approvals are blocked, so users needing new-device access must fall back to master-password unlock); restricting or monitoring access to the /auth-requests/admin-request path and the unauthenticated auth-request read endpoint at the reverse proxy or WAF, alerting on admin-request bodies whose email does not match the caller's session (trade-off: may break legitimate flows and requires session-to-email correlation); and rotating/re-keying vaults and revoking sessions for any accounts suspected to have had requests approved. Track the advisory at https://www.vulncheck.com/advisories/bitwarden-server-authorization-bypass-via-admin-auth-request.
Traccar Traccar Server version 4.0 and earlier contains a CWE-94: Improper Control of Generation of Code ('Code Injectio
Provider service users in Bitwarden Server Cloud can hijack arbitrary organizations via unauthorized API endpoint access
NoMachine Server is affected by Integer Overflow. Rated high severity (CVSS 8.8), this vulnerability is low attack compl
NoMachine Server is affected by Buffer Overflow. Rated high severity (CVSS 8.8), this vulnerability is low attack comple
Authentication bypass in Bitwarden Server versions prior to 2026.4.1 allows authenticated users with SCIM management pri
JetAudio jetCast Server 2.0 contains a stack-based buffer overflow vulnerability in the Log Directory configuration fiel
A broken authentication vulnerability in 4D SAS 4D Server software v17, v18, v19 R7, and earlier allows attackers to sen
An information disclosure vulnerability in 4D SAS 4D Server Application v17, v18, v19 R7 and earlier allows attackers to
Privilege escalation in self-hosted Bitwarden Server before 2026.5.0 lets an authenticated organization member holding a
Audit log integrity across all Bitwarden Server organizations can be undermined by any authenticated user, who may injec
In the webmail component in IceWarp Server 11.3.1.5, there was an XSS vulnerability discovered in the "language" paramet
Vela is a Pipeline Automation (CI/CD) framework built on Linux container technology written in Golang. Rated critical se
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today