CVE-2026-43640: Incorrect Implementation of Authentication Algorithm in bitwarden server
Bitwarden Server prior to v2026.4.1 does not require master-password re-authentication when retrieving or rotating an organization's SCIM API key, allowing an authenticated user with SCIM management privileges to obtain the key using only a valid session.
AI Analysis
Technical Summary
Bitwarden Server before version 2026.4.1 has an authentication design flaw where master-password re-authentication is not enforced during retrieval or rotation of an organization's SCIM API key. Consequently, any user authenticated with SCIM management privileges can access the SCIM API key by leveraging an active session, bypassing the expected additional authentication layer.
Potential Impact
An authenticated user with SCIM management privileges can obtain the organization's SCIM API key without needing to re-enter the master password. This could lead to unauthorized access or misuse of the SCIM API key, potentially compromising identity management integrations that rely on this key. The vulnerability has a CVSS 4.0 score of 8.6, indicating high severity.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects versions prior to v2026.4.1, upgrading to version 2026.4.1 or later is likely required once the vendor releases an official fix. Until then, restrict SCIM management privileges to trusted users and monitor for unusual activity related to SCIM API key usage.
CVE-2026-43640: Incorrect Implementation of Authentication Algorithm in bitwarden server
Description
Bitwarden Server prior to v2026.4.1 does not require master-password re-authentication when retrieving or rotating an organization's SCIM API key, allowing an authenticated user with SCIM management privileges to obtain the key using only a valid session.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Bitwarden Server before version 2026.4.1 has an authentication design flaw where master-password re-authentication is not enforced during retrieval or rotation of an organization's SCIM API key. Consequently, any user authenticated with SCIM management privileges can access the SCIM API key by leveraging an active session, bypassing the expected additional authentication layer.
Potential Impact
An authenticated user with SCIM management privileges can obtain the organization's SCIM API key without needing to re-enter the master password. This could lead to unauthorized access or misuse of the SCIM API key, potentially compromising identity management integrations that rely on this key. The vulnerability has a CVSS 4.0 score of 8.6, indicating high severity.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects versions prior to v2026.4.1, upgrading to version 2026.4.1 or later is likely required once the vendor releases an official fix. Until then, restrict SCIM management privileges to trusted users and monitor for unusual activity related to SCIM API key usage.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-05-01T18:22:45.642Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a021aa7cbff5d8610430524
Added to database: 5/11/2026, 6:06:31 PM
Last enriched: 5/11/2026, 6:21:42 PM
Last updated: 5/12/2026, 3:47:47 AM
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.