CVE-2026-43638 Bitwarden Server < 2026.4.1 Missing Authorization via Organization Cipher Import

Bitwarden Server prior to v2026.4.1 contains a missing authorization vulnerability that allows any authenticated user to write ciphers into an arbitrary organization via POST /ciphers/import-organization by submitting an empty collections array, which causes the server-side permission check to be...

CVE-2026-43638

Bitwarden Server prior to v2026.4.1 contains a missing authorization vulnerability that allows any authenticated user to write ciphers into an arbitrary organization via POST /ciphers/import-organization by submitting an empty collections array, which causes the server-side permission check to be...

PT-2026-39716

Bitwarden Server prior to v2026.4.0 contains a missing authorization vulnerability that allows a provider service user to add an arbitrary organization to their provider via POST /providers/providerId/clients/existing, resulting in takeover of the target organization; self-hosted installations ar...

PT-2026-39662

Bitwarden Server prior to v2026.4.1 contains a missing authorization vulnerability that allows any authenticated user to write ciphers into an arbitrary organization via POST /ciphers/import-organization by submitting an empty collections array, which causes the server-side permission check to be...

Vaultwarden 安全漏洞

Vaultwarden is an alternative implementation of the Bitwarden server API, developed by Daniel García. Versions of Vaultwarden prior to 1.35.4 contained security vulnerabilities. These vulnerabilities stemmed from the Manager’s ability to execute multiple management operations even when the...

EUVD-2019-9366

Malware in sbrugna...

EUVD-2020-7858

Malware in sbrugna...

EUVD-2025-3679

Malicious code in bioql PyPI...

CVE-2020-15879

Bitwarden Server 1.35.1 allows SSRF because it does not consider certain IPv6 addresses ones beginning with fc, fd, fe, or ff, and the :: address and certain IPv4 addresses 0.0.0.0/8, 127.0.0.0/8, and 169.254.0.0/16...

CVE-2019-19766

The Bitwarden server through 1.32.0 has a potentially unwanted KDF...

[SECURITY] Fedora 41 Update: vaultwarden-1.33.2-1.fc41

Unofficial Bitwarden compatible server...

[SECURITY] Fedora 40 Update: vaultwarden-1.33.0-1.fc40

Unofficial Bitwarden compatible server...

Bitwarden Server Code Issue Vulnerability

Bitwarden is a U.S. Bitwarden company's open source password manager. Bitwarden server is Bitwarden's core infrastructure back-end server. A code issue vulnerability exists in Bitwarden Server version 1.35.1. A remote attacker can exploit this vulnerability to obtain sensitive data with the help ...

CVE-2020-15879

Bitwarden Server 1.35.1 allows SSRF because it does not consider certain IPv6 addresses ones beginning with fc, fd, fe, or ff, and the :: address and certain IPv4 addresses 0.0.0.0/8, 127.0.0.0/8, and 169.254.0.0/16...

Server side request forgery (ssrf)

Bitwarden Server 1.35.1 allows SSRF because it does not consider certain IPv6 addresses ones beginning with fc, fd, fe, or ff, and the :: address and certain IPv4 addresses 0.0.0.0/8, 127.0.0.0/8, and 169.254.0.0/16...

Bitwarden server encryption issue vulnerability

Bitwarden is an open source password manager.Bitwarden server is the core infrastructure of Bitwarden back-end server . A cryptographic vulnerability exists in Bitwarden server version 1.32.0 and earlier versions. The vulnerability stems from a network system or product that does not properly use...