Vaultwarden, a Bitwarden-compatible server written in Rust, had a vulnerability (CVE-2026-43911) affecting versions before 1.35.5. The flaw involves refresh tokens not being invalidated when the user's security_stamp is rotated due to security-sensitive operations such as password changes, key derivation function changes, key rotations, email changes, organization admin password resets, or emergency access takeovers. This insufficient session expiration allows an attacker holding a previously obtained refresh token to maintain unauthorized session access even after the user has taken corrective security actions. The vulnerability is classified under CWE-613 and has a CVSS 3.1 base score of 6.8, indicating medium severity. The issue is resolved in Vaultwarden version 1.35.5.

An attacker who has obtained a refresh token prior to the user's security-sensitive changes can continue to access the user's session despite the user taking actions intended to secure their account. This compromises confidentiality and integrity of the user's session. There is no indication of availability impact. No known exploits are reported in the wild at this time.

Upgrade Vaultwarden to version 1.35.5 or later, where this vulnerability is fixed by properly invalidating refresh tokens upon security_stamp rotation. Since this is an on-premises product, administrators should apply the update promptly to mitigate the risk. Patch status is confirmed fixed in version 1.35.5.