vaultwarden
1.37.5Unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs
- Maintenance
- ActiveBased on the last push: commit history is not collected yet
- License
- AGPL-3.0Copyleft · OSI-approved
- Security
- 30 advisories6 high, 23 medium, 1 low
- Supported versions
- No scheduleendoflife.date does not track this project
70.8k stars · 3.5k forks · 87 open issues · last release 13 days ago · data checked 4 hours ago
Security advisories
All advisories on GitHubThe 30 most recent advisories published by the maintainers: 6 high, 23 medium, 1 low. Check the patched version against the one you run.
- mediumGHSA-7ccc-c43j-4p36Oct 28, 2026Organization member can move personal items into an organization without collection access
- Affected
- <= 1.37.3
- Patched in
- 1.37.4
- highGHSA-69q9-v8p6-xvx3Oct 28, 2026Revoked or unconfirmed organization member retains read and delete access to organization ciphers
- Affected
- <= 1.37.3
- Patched in
- 1.37.4
- mediumGHSA-q5x6-grh5-fqgcOct 28, 2026Unbounded client-declared attachment fileSize causes an out-of-bounds panic that permanently breaks vault sync for every user who can see the cipher
- Affected
- <= 1.37.3
- Patched in
- 1.37.4
- mediumGHSA-v576-3wvq-xh3cOct 28, 2026Loop-carried user_created flag in send_invite deletes a pre-existing user's account and entire vault when an invite e-mail fails
- Affected
- >= 1.33.0, <= 1.37.3
- Patched in
- 1.37.4
- mediumGHSA-64mc-4p6f-r7x9Oct 28, 2026Revoked or unconfirmed organization Admin can read cipher audit logs
- Affected
- <= 1.37.3
- Patched in
- 1.37.4
- lowGHSA-qwx4-wcv4-mpcvOct 28, 2026Organization Admin can revoke and delete Owners through an Admin-mintable organization API key
- Affected
- <=1.37.3
- Patched in
- 1.37.4
- mediumGHSA-7jg8-8m5x-6j9rOct 28, 2026vaultwarden: device-level 2FA "remember" tokens survive admin-initiated 2FA removal, allowing 2FA bypass for up to 30 days (residual gap in fix f1ff613)
- Affected
- <=1.37.3
- Patched in
- 1.37.4
- mediumGHSA-wc45-m6pv-rrf9Oct 3, 2026Send access limits not enforced on the new Send access endpoints
- Affected
- >1.36.0, < 1.37.0
- Patched in
- 1.37.0
- mediumGHSA-rxhg-2pw9-vf25Oct 3, 2026Send max_access_count can be exceeded by concurrent access requests
- Affected
- <= 1.36.0
- Patched in
- 1.37.0
- mediumGHSA-455c-vgg9-jxw8Oct 3, 2026Failed cipher share leaves a cross-organization collection link that grants access to the cipher
- Affected
- < 1.37.0
- Patched in
- 1.37.0
- mediumCVE-2026-116678Oct 3, 2026Icon endpoint SSRF fix bypass via second-stage favicon IP literal URLs
- Affected
- <= 1.36.0
- Patched in
- 1.37.0
- mediumGHSA-rqf8-2568-r7mcOct 3, 2026Manager-with-no-collections can enumerate org user/group → collection mappings (incomplete fix of GHSA-jjxg-p3v6-52ww)
- Affected
- <= 1.36.0
- Patched in
- 1.37.0
- mediumGHSA-88qc-6ch9-mc3jOct 3, 2026Directory-connector member import (ldap_import) skips org-policy enforcement (check_user_allowed), bypassing the Single-Organization and required-2FA policies
- Affected
- <= 1.36.0
- Patched in
- 1.37.0
- mediumGHSA-xwf8-pjh7-h589Oct 3, 2026Cross-organization full cipher access via unguarded full-access-group query
- Affected
- <= 1.36.0
- Patched in
- 1.37.0
- mediumGHSA-vh5m-fc9v-m84gOct 3, 2026SSRF filter bypass (regex not applied post-resolution)
- Affected
- <=1.36.0
- Patched in
- 1.37.0
- mediumGHSA-f3qw-qg77-hmm4Oct 3, 2026IDOR in Organization Import Allows Unauthorized Data Injection
- Affected
- ≤ 1.36.0
- Patched in
- 1.37.0
- mediumGHSA-96f7-78q5-j345Oct 3, 2026Unauthenticated WebSocket connection flooding on /notifications/anonymous-hub (resource-exhaustion DoS)
- Affected
- <= 1.36.0
- Patched in
- 1.37.0
- mediumGHSA-jq2g-h4xr-4mcrOct 3, 2026Cipher Ownership Confusion in Organization Import
- Affected
- ≤ 1.36.0
- Patched in
- 1.37.0
- highCVE-2026-47158May 19, 2026CSRF in SSO Authorization Flow
- Affected
- <1.35.8
- Patched in
- 1.36.0
- mediumCVE-2026-47159May 19, 2026Authentication Flow Information Disclosure in SSO Discovery Allows Organization Enumeration and Pre-Validation Token Exposure
- Affected
- <1.35.8
- Patched in
- 1.36.0
- highCVE-2026-47164May 19, 2026SSO Email Auto-Link Can Bind an Existing Local Account to an Attacker-Controlled IdP Identity
- Affected
- <=1.35.8
- Patched in
- 1.36.0
- mediumCVE-2026-47160May 19, 2026Server-side request forgery (SSRF) via Icon Endpoint Decimal/Hex/Octal IP Bypass
- Affected
- <1.35.8
- Patched in
- 1.36.0
- mediumCVE-2026-33420Apr 26, 2026Missing authorization check in /organizations/{org_id}/collections/details allows Manager-role users to enumerate all collections
- Affected
- 1.35.4
- Patched in
- 1.35.5
- highCVE-2026-43914Apr 25, 2026Brute-force protection bypass vulnerability
- Affected
- <1.35.4
- Patched in
- 1.35.4
- highCVE-2026-43913Apr 25, 2026Unconfirmed Owner Can Purge Entire Organization Vault
- Affected
- <=1.35.4
- Patched in
- 1.35.5
- highCVE-2026-43912Apr 25, 2026Cross-Org Group Binding Enables Unauthorized Read And Write Access Into Another Organization
- Affected
- <=1.35.4
- Patched in
- 1.35.5
- mediumCVE-2026-43911Apr 25, 2026Refresh tokens not invalidated on security stamp rotation
- Affected
- <= 1.35.4
- Patched in
- 1.35.5
- mediumCVE-2026-31835Apr 25, 2026Vaultwarden: WebAuthn assertion processed before signature verification allows persistent credential backup-flag tampering
- Affected
- <= 1.35.4
- Patched in
- 1.35.5
- mediumCVE-2026-27898Mar 4, 2026Unauthorized Access via Partial Update API on Another User’s Cipher
- Affected
- 1.35.3
- Patched in
- 1.35.4
- mediumCVE-2026-27801Mar 4, 20262FA Bypass on Protected Actions due to Faulty Rate Limit Enforcement
- Affected
- 1.34.3
- Patched in
- 1.35.0