Bitwarden vulnerabilities
11 published CVEs name Bitwarden among the affected products.
- 11Published CVEs11 of them scored
- 11Last 12 monthspublished in the last year
- 1Critical5 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-119414
Bitwarden Server before 2026.10.1 Authorization Bypass via POST /api/ciphers/create
bitwarden · server
Medium5.3 - CVE-2026-101878
Bitwarden Server 2025.6.0 < 2025.6.0 Authentication Bypass via SSO Identifier Truncation
bitwarden · bitwarden server
High7.7 - CVE-2026-71959
Bitwarden Server < 2026.7.2 Audit Log Injection via POST /collect
bitwarden · server
Medium6.9 - CVE-2026-60104
Bitwarden Server < 2026.6.0 Authorization Bypass via Admin Auth Request
bitwarden · server
Critical9.3 - CVE-2026-57522
Bitwarden Server < 2026.5.0 JSON Injection via Webhook Templates
bitwarden · server
Low2.3 - CVE-2026-57521
Bitwarden Server < 2026.5.0 Broken Access Control via PreviewInvoiceController
bitwarden · server
Medium5.3 - CVE-2026-57520
Bitwarden Server < 2026.5.0 Privilege Escalation via Bulk User Remove Endpoint
bitwarden · server
High7.1 - CVE-2026-43640
Bitwarden Server < 2026.4.1 Authentication Bypass via SCIM API Key
bitwarden · server
High8.6 - CVE-2026-43639
Bitwarden Server < 2026.4.0 Missing Authorization via Provider Clients
bitwarden · server
High8.9 - CVE-2026-43638
Bitwarden Server < 2026.4.1 Missing Authorization via Organization Cipher Import
bitwarden · server
Medium5.3