Bitwarden: >> Server >> 1.10.0 Security Vulnerabilities
Bitwarden Server prior to v2026.4.1 does not require master-password re-authentication when retrieving or rotating an organization's SCIM API key, allowing an authenticated user with SCIM management privileges to obtain the key using only a valid session.
CVSS Score
8.6
EPSS Score
0.005
Published
2026-05-11
Bitwarden Server prior to v2026.4.1 contains a missing authorization vulnerability that allows any authenticated user to write ciphers into an arbitrary organization via `POST /ciphers/import-organization` by submitting an empty `collections` array, which causes the server-side permission check to be skipped.
CVSS Score
5.3
EPSS Score
0.002
Published
2026-05-11
Bitwarden Server prior to v2026.4.0 contains a missing authorization vulnerability that allows a provider service user to add an arbitrary organization to their provider via `POST /providers/{providerId}/clients/existing`, resulting in takeover of the target organization; self-hosted installations are unaffected as this endpoint is restricted to Cloud via SelfHosted(NotSelfHostedOnly = true).
CVSS Score
8.9
EPSS Score
0.006
Published
2026-05-11
The Bitwarden server through 1.32.0 has a potentially unwanted KDF.
CVSS Score
7.5
EPSS Score
0.013
Published
2019-12-12