Skip to content
Threat Feed
Subscribe

Tag

Bitwarden

2 briefs RSS
high advisory

CVE-2026-60104 - Bitwarden Server Vault Key Disclosure and Account Takeover

A low-privileged Bitwarden organization member can exploit CVE-2026-60104 in Bitwarden Server versions prior to 2026.6.0, which allows an attacker to obtain another user's vault key and access token by creating a Trusted Device Encryption authentication request bound to an attacker-controlled public key, leading to account takeover.

Bitwarden Server < 2026.6.0 vulnerability cve account-takeover credential-access data-disclosure bitwarden
7t 1c
high advisory

Bitwarden Server Missing Authorization Vulnerability Leading to Organization Takeover (CVE-2026-43639)

Bitwarden Server prior to v2026.4.0 contains a missing authorization vulnerability (CVE-2026-43639) that allows a provider service user to add an arbitrary organization to their provider via `POST /providers/{providerId}/clients/existing`, resulting in takeover of the target organization in cloud-hosted deployments.

Bitwarden Server cve bitwarden takeover missing-authorization cloud
2r 1t 1c