Bitwarden is a password-management and vault platform whose focused vulnerability footprint centers on authentication, authorization, and sensitive-data handling in its server and core application products. Vulnerabilities affecting the vendor skew toward serious outcomes, with a meaningful share reaching critical severity, and cluster around access-control weaknesses, cleartext storage of credentials and secrets, and code-injection vectors that reflect the high-value nature of a centralized credential store. Defenders should monitor this vendor's releases closely given the sensitive data at stake; live severity and exploitation figures are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Bitwarden over time
Signals from CVEs in this vendor scope (14 CVEs).
14 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2026-60104HIGH Bitwarden Server before 2026.6.0 does not verify that the email in a POST /auth-requests/admin-request body belongs to the authenticated caller, allowing a low-privileged organizat | Jul 8, 2026 | 8.7 | 39 | NO | NO |
CVE-2026-43639CRITICAL Bitwarden Server prior to v2026.4.0 contains a missing authorization vulnerability that allows a provider service user to add an arbitrary organization to their provider via `POST | May 11, 2026 | 9.1 | 37 | NO | NO |
CVE-2026-42994CRITICAL Bitwarden CLI 2026.4.0 from 2026-04-22T21:57Z to 2026-04-22T23:30Z, when obtained from npm, had embedded malicious code. This is related to a Checkmarx supply chain incident. | May 1, 2026 | 9.8 | 37 | NO | NO |
CVE-2026-43640HIGH Bitwarden Server prior to v2026.4.1 does not require master-password re-authentication when retrieving or rotating an organization's SCIM API key, allowing an authenticated user wi | May 11, 2026 | 8.1 | 35 | NO | NO |
CVE-2026-57520HIGH Bitwarden Server before 2026.5.0 contains a privilege escalation vulnerability that allows authenticated Custom users with ManageUsers permission to remove Admin accounts from an o | Jun 25, 2026 | 7.1 | 29 | NO | NO |
CVE-2020-15879HIGH Bitwarden Server 1.35.1 allows SSRF because it does not consider certain IPv6 addresses (ones beginning with fc, fd, fe, or ff, and the :: address) and certain IPv4 addresses (0.0. | Jul 21, 2020 | 7.5 | 26 | NO | NO |
CVE-2026-43638MEDIUM Bitwarden Server prior to v2026.4.1 contains a missing authorization vulnerability that allows any authenticated user to write ciphers into an arbitrary organization via `POST /cip | May 11, 2026 | 5.4 | 25 | NO | NO |
CVE-2026-57522MEDIUM Bitwarden Server before 2026.5.0 contains a JSON injection vulnerability in IntegrationTemplateProcessor.ReplaceTokens(), which substitutes user-controlled values into event-integr | Jun 25, 2026 | 5.0 | 24 | NO | NO |
CVE-2018-25081HIGH Bitwarden through 2023.2.1 offers password auto-fill within a cross-domain IFRAME element. NOTE: the vendor's position is that there have been important legitimate cross-domain con | Mar 9, 2023 | 7.5 | 24 | NO | NO |
CVE-2019-19766HIGH The Bitwarden server through 1.32.0 has a potentially unwanted KDF. | Dec 12, 2019 | 7.5 | 24 | NO | NO |
Signals from CVEs in this vendor scope (14 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Bitwarden.
Media articles that mention a CVE ID that affects a product developed by Bitwarden — matched by CVE ID, not by vendor name.