Threats affecting pkg:github/dani-garcia/vaultwarden

CVE-2026-116678 is a server-side request forgery (SSRF) vulnerability in Vaultwarden versions prior to 1.37.0. The flaw arises because the icon downloader does not properly apply host-blocking checks to second-stage favicon URLs parsed from attacker-controlled HTML, allowing an unauthenticated remote attacker to cause the server to make requests to internal or loopback IP addresses. This can expose internal responses or reveal network reachability information. The issue is fixed in version 1.37.0.

Vaultwarden versions prior to 1.35.4 contain a vulnerability that allows attackers to bypass brute-force login protections when email two-factor authentication (2FA) is enabled. The vulnerability arises because the 2FA email function send_email_login acts as an oracle to verify username-password correctness without rate limiting. This flaw enables brute-force password attempts even against accounts without email 2FA configured. The issue is fixed in version 1.35.4. The CVSS score is 7.3, indicating a high severity vulnerability.

Vaultwarden versions prior to 1.35.5 contain an improper authorization vulnerability that allows an attacker with admin privileges in one organization and low privileges in another to escalate access across organizations. The flaw arises because group-management endpoints do not verify that membership and collection IDs belong to the same organization, enabling unauthorized access and modification of vault data from another organization. This vulnerability is fixed in version 1.35.5.

Vaultwarden versions prior to 1.35.5 contain a vulnerability where refresh tokens are not invalidated after certain security-sensitive user actions, such as password changes or key rotations. This allows an attacker with a previously obtained refresh token to maintain session access despite the user attempting to secure their account. The issue is identified as insufficient session expiration (CWE-613) and has a CVSS score of 6.8 (medium severity). The vulnerability is fixed in version 1.35.5.

Vaultwarden versions 1.35.4 and earlier contain a missing authorization check in the get_org_collections_details API endpoint. This flaw allows users with Manager role but restricted access (accessAll=False and no collection assignments) to retrieve sensitive organizational collection metadata, including names, UUIDs, and user/group-to-collection mappings. The issue was resolved in version 1.35.5.

Vaultwarden versions 1.35.4 and earlier contain a vulnerability in the WebAuthn authentication flow where persistent credential metadata flags are updated based on unverified authenticator data before signature validation. An attacker who knows a user's password but cannot produce a valid WebAuthn signature can modify these backup flags, causing a persistent denial of service for WebAuthn two-factor authentication on that user's credential. The issue is fixed in version 1.35.5.

Vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs. Prior to version 1.35.4, when a Manager has manage=false for a given collection, they can still perform several management operations as long as they have access to the collection. This issue has been patched in version 1.35.4.

Vaultwarden v1.32.5 was discovered to contain an authenticated reflected cross-site scripting (XSS) vulnerability via the component /api/core/mod.rs.

An issue in the component src/api/identity.rs of Vaultwarden prior to v1.32.5 allows attackers to impersonate users, including Administrators, via a crafted authorization request.

An HTML injection vulnerability in Vaultwarden prior to v1.32.5 allows attackers to execute arbitrary code via injecting a crafted payload into the username field of an e-mail message.