Skip to content
Threat Feed
Subscribe

Product

Bitwarden Server < 2026.6.0

1 brief RSS
high advisory

CVE-2026-60104 - Bitwarden Server Vault Key Disclosure and Account Takeover

A low-privileged Bitwarden organization member can exploit CVE-2026-60104 in Bitwarden Server versions prior to 2026.6.0, which allows an attacker to obtain another user's vault key and access token by creating a Trusted Device Encryption authentication request bound to an attacker-controlled public key, leading to account takeover.

Bitwarden Server < 2026.6.0 vulnerability cve account-takeover credential-access data-disclosure bitwarden
7t 1c