Threats tagged 'ghsa-2fcc-4gv4-mvr7'

CVE-2026-101878 is a vulnerability in Bitwarden Server versions 2025.6.0 up to but not including 2026.5.0. It involves an incorrect implementation of the authentication algorithm where the @ExternalId parameter in a stored procedure is declared with a shorter NVARCHAR(50) length than the actual NVARCHAR(300) column it queries. This causes silent truncation of the SSO login identifier on SQL Server deployments, allowing an attacker whose identity-provider identifier begins with another user's full 50-character identifier to authenticate as that user and obtain their access token.