Threat Intelligence Database

Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.36.0, Vaultwarden's SSO login flow checked the IdP email_verified claim only for new-user creation and not when SSO_SIGNUPS_MATCH_EMAIL=true linked an IdP identity to an existing local account, allowing an attacker-controlled IdP identity asserting a victim email address to bind to and authenticate as that account. This issue is fixed in version 1.36.0.

Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.36.0, Vaultwarden's /icons/{domain}/icon.png endpoint used src/http_client.rs checks including should_block_address() and post_resolve() that missed decimal, hexadecimal, and octal IP representations, allowing SSRF through the icon-fetching HTTP client for blind internal network or port discovery. This issue is fixed in version 1.36.0.

Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.36.0, Vaultwarden's SSO discovery and pre-validation flow returned organization-related SSO metadata including organizationIdentifier values for arbitrary email addresses and allowed a valid pre-validation JWT to be obtained with only the discovered identifier, enabling SSO-enabled organization enumeration and authentication workflow abuse. This issue is fixed in version 1.36.0.

Vaultwarden versions prior to 1.36.0 contain a Cross-Site Request Forgery (CSRF) vulnerability in the Single Sign-On (SSO) authorization flow. The issue arises because the OAuth state parameter is not bound to the initiating browser session, attacker-controlled PKCE parameters are accepted, and SsoAuth records remain after failed token exchanges. This allows an unauthenticated attacker to induce Identity Provider (IdP) authentication and redeem tokens to gain a fully authenticated session. The vulnerability is fixed in version 1.36.0.