CVE-2026-60104 is an authorization bypass vulnerability in Bitwarden Server before version 2026.6.0. The issue arises because the server fails to verify that the email address in a POST /auth-requests/admin-request belongs to the authenticated user making the request. An attacker with low privileges can create a Trusted Device Encryption authentication request bound to a public key they control but specifying a victim's email. Once this request is approved, the attacker can retrieve the victim's vault key and a victim-scoped access token from an unauthenticated endpoint, resulting in disclosure of sensitive credentials and potential account takeover.

An attacker with low privileges in an organization can obtain another user's vault key and access token, enabling unauthorized access to the victim's vault and potentially full account takeover. This compromises confidentiality and integrity of the victim's stored secrets. The vulnerability has a critical severity with a CVSS 4.0 score of 9.3, indicating high exploitability and impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the affected versions are prior to 2026.6.0, upgrading to version 2026.6.0 or later is expected to address the issue once a patch is released. Until then, restrict low-privileged user permissions and monitor for suspicious authentication requests if possible.