CVE-2026-43640

HIGH EPSS 39.2%
Published May 11, 20261mo ago · Modified Jun 17, 20261w ago
8.6 CVSS 4.0
High
Find Similar
Published May 11, 2026 1mo ago
Last Modified Jun 17, 2026 1w ago

Description

Bitwarden Server prior to v2026.4.1 does not require master-password re-authentication when retrieving or rotating an organization's SCIM API key, allowing an authenticated user with SCIM management privileges to obtain the key using only a valid session.

CVSS Details

Base Score
8.6
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Network
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope X

Threat Intelligence

EPSS Exploit Probability
39.2% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 1

CWE-303

Affected Products 1

VendorProductVersionRange
bitwardenserver* <2026.4.1

References 5

  • github.com https://github.com/bitwarden/server/commit/eb251d9bf80724c87b187661783b9354d1784083
    Patch
  • github.com https://github.com/bitwarden/server/pull/7403
    Issue TrackingPatch
  • github.com https://github.com/bitwarden/server/releases/tag/v2026.4.1
    Release Notes
  • sanjokkarki.com.np https://sanjokkarki.com.np/blog/bitwarden-scim-key-bypass
    ExploitThird Party Advisory
  • vulncheck.com https://www.vulncheck.com/advisories/bitwarden-server-authentication-bypass-via-scim-api-key
    Third Party Advisory

Remediation

  • github.com https://github.com/bitwarden/server/commit/eb251d9bf80724c87b187661783b9354d1784083
    Patch
  • github.com https://github.com/bitwarden/server/pull/7403
    Issue TrackingPatch