Bitwarden Server
Monthly
Authentication bypass in self-hosted Bitwarden Server versions 2025.6.0 through 2026.5.0 backed by Microsoft SQL Server allows a user with a provisionable SSO identity to obtain a victim-scoped access token. The stored procedure User_ReadBySsoUserOrganizationIdExternalId declares its @ExternalId parameter as NVARCHAR(50) while the column it queries stores NVARCHAR(300), so an identity-provider ExternalId whose value begins with a victim organization member's full 50-character identifier is silently truncated and matches that member's record during SSO login. Exploitation requires organization SSO login enabled on a SQL Server deployment plus knowledge or control of an IdP identifier sharing the victim's 50-character prefix (CVSS vector shows PR:L), making the attack targeted rather than broadly opportunistic; publicly available exploit code exists but there is no CISA KEV confirmation of active exploitation. The flaw is fixed in Bitwarden Server 2026.5.0, and despite the supplied 'Information Disclosure' tag its actual outcome is account takeover (CWE-303).
Authentication bypass in self-hosted Bitwarden Server versions 2025.6.0 through 2026.5.0 backed by Microsoft SQL Server allows a user with a provisionable SSO identity to obtain a victim-scoped access token. The stored procedure User_ReadBySsoUserOrganizationIdExternalId declares its @ExternalId parameter as NVARCHAR(50) while the column it queries stores NVARCHAR(300), so an identity-provider ExternalId whose value begins with a victim organization member's full 50-character identifier is silently truncated and matches that member's record during SSO login. Exploitation requires organization SSO login enabled on a SQL Server deployment plus knowledge or control of an IdP identifier sharing the victim's 50-character prefix (CVSS vector shows PR:L), making the attack targeted rather than broadly opportunistic; publicly available exploit code exists but there is no CISA KEV confirmation of active exploitation. The flaw is fixed in Bitwarden Server 2026.5.0, and despite the supplied 'Information Disclosure' tag its actual outcome is account takeover (CWE-303).