CVE-2026-47164

Vaultwarden (Rust) prior to 1.36.0 has an authentication flaw in its SSO flow: when SSO_SIGNUPS_MATCH_EMAIL=true, an IdP identity can bind to an existing local Vaultwarden account by asserting a victim email, due to checking the IdP email_verified claim only during new-user creation. This could a...

CVE-2026-47164

creationtimestamp| type| source ---|---|--- 2026-05-20 14:58:37+00:00| seen| https://gist.github.com/Atomics-hub/546bf5d8d27b37858eec964a75f37206...