vaultwarden

An alternative server implementation of the Bitwarden Client API, written in Rust and compatible with official Bitwarden clients disclaimer, perfect for self-hosted deployment where running the official resource-heavy service might not be ideal. !Issues Openhttps://img.shields.io/github/issues...

vaultwarden-ip-header-spoof

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · vaultwarden-ip-header-spoof Write-up: https://abraxaslabs.tech/research/vaultwarden-ip-header-spoof vaultwarden-ip-header-spoof Vaultwarden 1.37.3 - dani-garcia Default IPHEADER=X-Real-IP plus...

CVE-2026-43914-PoC

CVE-2026-43914 — Vaultwarden Email-2FA Brute-Force Protection Bypass Proof-of-concept for CVE-2026-43914 : when Email 2FA is enabled, Vaultwarden's login brute-force protection can be completely bypassed via the unauthenticated POST /api/two-factor/send-email-login endpoint, which acts as an...

CVE-2026-116678

A flaw was found in Vaultwarden. When internal icon downloading is enabled, the server fails to properly validate secondary favicon web addresses extracted from untrusted pages against network access restrictions. A remote, unauthenticated attacker can exploit this vulnerability to cause...

CVE-2026-116678

Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to version 1.37.0, the Vaultwarden icon downloader validates the initial icon host and DNS results but passes favicon URLs parsed from attacker-controlled HTML to getpagewithreferer without applying shouldblockhost to the...

CVE-2026-116678 Vaultwarden: Icon endpoint SSRF fix bypass via second-stage favicon IP literal URLs

Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to version 1.37.0, the Vaultwarden icon downloader validates the initial icon host and DNS results but passes favicon URLs parsed from attacker-controlled HTML to getpagewithreferer without applying shouldblockhost to the...

EUVD-2026-111236

Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to version 1.37.0, the Vaultwarden icon downloader validates the initial icon host and DNS results but passes favicon URLs parsed from attacker-controlled HTML to getpagewithreferer without applying shouldblockhost to the...

CVE-2026-116678

The Vaultwarden Bitwarden-compatible server (prior to version 1.37.0 ) is vulnerable to a Server-Side Request Forgery (SSRF) flaw in its icon downloader. While the server validates initial host DNS results, it fails to apply the should_block_host() check to second-stage favicon URLs parsed from a...

CVE-2026-116678

Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to version 1.37.0, the Vaultwarden icon downloader validates the initial icon host and DNS results but passes favicon URLs parsed from attacker-controlled HTML to getpagewithreferer without applying shouldblockhost to the...

CVE-2026-116678 Vaultwarden: Icon endpoint SSRF fix bypass via second-stage favicon IP literal URLs

Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to version 1.37.0, the Vaultwarden icon downloader validates the initial icon host and DNS results but passes favicon URLs parsed from attacker-controlled HTML to getpagewithreferer without applying shouldblockhost to the...

CVE-2026-116678 Vaultwarden: Icon endpoint SSRF fix bypass via second-stage favicon IP literal URLs

Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to version 1.37.0, the Vaultwarden icon downloader validates the initial icon host and DNS results but passes favicon URLs parsed from attacker-controlled HTML to getpagewithreferer without applying shouldblockhost to the...

PT-2026-127180

Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to version 1.37.0, the Vaultwarden icon downloader validates the initial icon host and DNS results but passes favicon URLs parsed from attacker-controlled HTML to get page with referer without applying should block host to the...

CVE-2026-116678: Server-Side Request Forgery (SSRF)

Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to version 1.37.0, the Vaultwarden icon downloader validates the initial icon host and DNS results but passes favicon URLs parsed from attacker-controlled HTML to getpagewithreferer without applying shouldblockhost to the...

Daniel García Vaultwarden server request forgery vulnerability

Versions prior to 1.37.0 of Daniel García Vaultwarden contain a server-side request forgery vulnerability. This vulnerability arises because the icon downloader fails to apply the shouldblockhost check to the host associated with the second-stage favicon URL derived from HTML that is controlled b...

Vaultwarden -- Multiple vulnerabilities

The Vaultwarden project reports: Organization member revocation GHSA-69q9-v8p6-xvx3 High, 8.1 Two-factor authentication GHSA-7jg8-8m5x-6j9r Medium, 6.8 Organization invitations GHSA-v576-3wvq-xh3c Medium, 6.8 Attachments GHSA-q5x6-grh5-fqgc Medium, 6.5 Organization event logs GHSA-64mc-4p6f-r7x9...

FreeBSD : Vaultwarden -- Multiple vulnerabilities (3a72cd47-c157-11f1-a6ea-8447094a420f)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 3a72cd47-c157-11f1-a6ea-8447094a420f advisory. The Vaultwarden project reports: Tenable has extracted the preceding description block directly from th...

CVE-2026-26012

CVE-2026-26012 - Prueba de Concepto Omisión de Permisos de Colección para Miembros Autenticados y Enumeración de Cifrados Vaultwarden Referencia NVD: CVE-2026-26012 CVSSv3| Vector de Ataque| Complejidad de Ataque| Privilegios Requeridos| Interacción del Usuario| Confidencialidad| Integridad|...

CVE-2026-95814

A flaw was found in Vaultwarden. This vulnerability allows revoked and not-yet-confirmed organization members to bypass authorization checks. By exploiting missing status filters in specific access-restriction queries, these unauthorized members can retain read, write, delete, and attachment acce...

CVE-2026-95814

Vaultwarden through 1.37.3 omits organization membership status validation from three cipher access-restriction queries, allowing revoked and not-yet-confirmed members to retain read, write, delete, and attachment access to organization ciphers. Attackers with revoked or pending membership can...

CVE-2026-95814 Vaultwarden through 1.37.3 Authorization Bypass via Missing Status Check

Vaultwarden through 1.37.3 omits organization membership status validation from three cipher access-restriction queries, allowing revoked and not-yet-confirmed members to retain read, write, delete, and attachment access to organization ciphers. Attackers with revoked or pending membership can...