CVE-2026-60104

Bitwarden Server before 2026.6.0 does not verify that the email in a POST /auth-requests/admin-request body belongs to the authenticated caller, allowing a low-privileged organization member to obtain another user's vault key and a victim-scoped access token by creating a Trusted Device Encryption authentication request, bound to an attacker-controlled public key, that is readable from an unauthenticated endpoint once approved resulting in disclosure of the victim's vault key and account takeover.

CVSS v3 8.7 HIGH

8.7^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.3 / Impact : 5.8

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/bitwarden/server/commit/dcf4c486b2b5bedecc03a48b427243328cc74a9a	Patch
https://github.com/bitwarden/server/pull/7615	Issue Tracking Patch
https://github.com/bitwarden/server/releases#release-v2026.6.0	Release Notes
https://sanjokkarki.com.np/blog/bitwarden-vault-key-heist	Exploit Third Party Advisory
https://www.vulncheck.com/advisories/bitwarden-server-authorization-bypass-via-admin-auth-request	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:bitwarden:server:*:*:*:*:*:*:*:*

History

25 Oct 2026, 17:10

Type	Values Removed	Values Added
Summary		(es) Bitwarden servidor anterior a 2026.6.0 no verifica que el correo electrónico en el cuerpo de una solicitud POST /auth-requests/admin-request pertenezca al llamador autenticado, permitiendo a un miembro de la organización con bajos privilegios obtener la clave de bóveda de otro usuario y un token de acceso con alcance de víctima al crear una solicitud de autenticación de cifrado de dispositivo de confianza, vinculada a una clave pública controlada por el atacante, que es legible desde un endpoint no autenticado una vez aprobada, lo que resulta en la divulgación de la clave de bóveda de la víctima y la toma de control de la cuenta.

Information

Published : 2026-07-08 20:17

Updated : 2026-10-25 17:10

NVD link : CVE-2026-60104

Mitre link : CVE-2026-60104

CVE.ORG link : CVE-2026-60104

JSON object : View

Products Affected

bitwarden

server

CWE

CWE-639

Authorization Bypass Through User-Controlled Key

{"id": "CVE-2026-60104", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-60104", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-09T13:35:41.639610Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.8, "exploitabilityScore": 2.3}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.0, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.1}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/bitwarden/server", "vendor": "bitwarden", "product": "server", "versions": [{"status": "affected", "version": "0", "lessThan": "2026.6.0", "versionType": "semver"}], "packageURL": "pkg:github/bitwarden/server", "defaultStatus": "affected"}]}], "published": "2026-07-08T20:17:00.413", "references": [{"url": "https://github.com/bitwarden/server/commit/dcf4c486b2b5bedecc03a48b427243328cc74a9a", "tags": ["Patch"], "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/bitwarden/server/pull/7615", "tags": ["Issue Tracking", "Patch"], "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/bitwarden/server/releases#release-v2026.6.0", "tags": ["Release Notes"], "source": "disclosure@vulncheck.com"}, {"url": "https://sanjokkarki.com.np/blog/bitwarden-vault-key-heist", "tags": ["Exploit", "Third Party Advisory"], "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/bitwarden-server-authorization-bypass-via-admin-auth-request", "tags": ["Third Party Advisory"], "source": "disclosure@vulncheck.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-639"}]}], "descriptions": [{"lang": "en", "value": "Bitwarden Server before 2026.6.0 does not verify that the email in a POST /auth-requests/admin-request body belongs to the authenticated caller, allowing a low-privileged organization member to obtain another user's vault key and a victim-scoped access token by creating a Trusted Device Encryption authentication request, bound to an attacker-controlled public key, that is readable from an unauthenticated endpoint once approved resulting in disclosure of the victim's vault key and account takeover."}, {"lang": "es", "value": "Bitwarden servidor anterior a 2026.6.0 no verifica que el correo electr\u00f3nico en el cuerpo de una solicitud POST /auth-requests/admin-request pertenezca al llamador autenticado, permitiendo a un miembro de la organizaci\u00f3n con bajos privilegios obtener la clave de b\u00f3veda de otro usuario y un token de acceso con alcance de v\u00edctima al crear una solicitud de autenticaci\u00f3n de cifrado de dispositivo de confianza, vinculada a una clave p\u00fablica controlada por el atacante, que es legible desde un endpoint no autenticado una vez aprobada, lo que resulta en la divulgaci\u00f3n de la clave de b\u00f3veda de la v\u00edctima y la toma de control de la cuenta."}], "lastModified": "2026-10-25T17:10:00.197", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:bitwarden:server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C3C37E1B-7E03-4441-9C68-5827C2BAEE4E", "versionEndExcluding": "2026.6.0"}], "operator": "OR"}]}], "sourceIdentifier": "disclosure@vulncheck.com"}