Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-101878: Bitwarden Server lets attacker log in as another user

CVE-2026-101878 · published 1 month ago

Summary

Bitwarden Server versions before the 2026.5.0 update can trim a long single sign‑on identifier, so a malicious user whose ID starts with a colleague’s full ID can sign in as that colleague and receive their access token. This means an attacker could gain the same permissions as the victim within the same organization. Upgrade the server to version 2026.5.0 or later, or apply the vendor’s patch, to stop the truncation problem.

What to do

Update bitwarden bitwarden server to version 2026.5.0 or later.

Affected software

Vendor	Product	Affected versions
bitwarden	bitwarden server	< 2026.5.0

Original advisory text

Bitwarden Server 2025.6.0 < 2025.6.0 Authentication Bypass via SSO Identifier Truncation

Bitwarden Server 2025.6.0 before 2026.5.0 declares the @ExternalId parameter of the User_ReadBySsoUserOrganizationIdExternalId stored procedure as NVARCHAR(50) while the column it queries stores NVARCHAR(300), silently truncating the SSO login identifier on SQL Server deployments and allowing a user whose identity-provider identifier begins with another organization member's full 50-character identifier to authenticate as that member and obtain a victim-scoped access token.

References

https://github.com/bitwarden/server/releases/tag/v2026.5.0 Vendor Advisory
https://www.vulncheck.com/advisories/bitwarden-server-authentication-bypass-via-... Vendor Advisory
https://github.com/bitwarden/server/pull/7501 Third Party Advisory
https://github.com/bitwarden/server/commit/27ae3d5455f723975fac03819eaeba8710666... Patch
https://sanjokkarki.com.np/blog/bitwarden-sso-externalid-truncation Exploit
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-1018... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-101878 Vendor Advisory
https://github.com/bitwarden/server Product

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

8.9 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-303Incorrect Implementation of Authentication Algorithm

Timeline

Published29 Sep 2026

Updated4 Nov 2026

First seen29 Sep 2026

Sources

CVE-2026-101878 · NVD

CVE-2026-101878 · MITRE

CVE-2026-101878 · OSV

Track software like this

Free during beta