CVE-2026-43640— Bitwarden Server < 2026.4.1 Authentication Bypass via SCIM API Key
Quick assessment
Affected
bitwarden server
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
bitwarden是Bitwarden开源的一款密码管理后端服务。 Bitwarden 2026.4.1之前版本存在安全漏洞，该漏洞源于检索或轮换组织SCIM API密钥时无需主密码重新认证，允许经过身份验证的用户仅使用有效会话获取密钥。
Possible ATT&CK Techniques 1 AI
T1098.004 · SSH Authorized Keys
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-43640
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Bitwarden Server < 2026.4.1 Authentication Bypass via SCIM API Key
Source: CVE Program / CVE List V5
Vulnerability Description
Bitwarden Server prior to v2026.4.1 does not require master-password re-authentication when retrieving or rotating an organization's SCIM API key, allowing an authenticated user with SCIM management privileges to obtain the key using only a valid session.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
认证算法的不正确实现
Source: CVE Program / CVE List V5
Vulnerability Title
bitwarden 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
bitwarden是Bitwarden开源的一款密码管理后端服务。 Bitwarden 2026.4.1之前版本存在安全漏洞，该漏洞源于检索或轮换组织SCIM API密钥时无需主密码重新认证，允许经过身份验证的用户仅使用有效会话获取密钥。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-43640
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-43640
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-43640 (2)
Vendor Advisories for CVE-2026-43640 (1)
Security Blog Posts for CVE-2026-43640 (1)
Vendor Pages for CVE-2026-43640 (1)
-
🔗 Release Version 2026.4.1 · bitwarden/server · GitHub release-notes
Same Patch Batch · bitwarden · 2026-05-11 · 3 CVEs total
| CVE-2026-43639 | 8.0 HIGH | Bitwarden Server < 2026.4.0 Missing Authorization via Provider Clients |
| CVE-2026-43638 | 5.4 MEDIUM | Bitwarden Server < 2026.4.1 Missing Authorization via Organization Cipher Import |
IV. Related Vulnerabilities
Same product: server
-
CVE-2026-72859
Budibase 3.39.4 before 3.40.0 Authorization Regression via S -
CVE-2026-72855
Budibase before 3.40.0 DNS Rebinding SSRF via OpenAPI and RE -
CVE-2026-72851
Budibase before 3.40.0 SQL Injection via Unauthenticated Web -
CVE-2026-72850
Budibase before 3.40.0 Arbitrary File Write via Path Travers -
CVE-2026-72849
Budibase before 3.40.0 Identity Confusion via Chat-Link Hand
Same vendor: bitwarden
-
CVE-2026-71959
Bitwarden Server < 2026.7.2 Audit Log Injection via POST /co -
CVE-2026-60104
Bitwarden Server < 2026.6.0 Authorization Bypass via Admin A -
CVE-2026-57522
Bitwarden Server < 2026.5.0 JSON Injection via Webhook Templ -
CVE-2026-57521
Bitwarden Server < 2026.5.0 Broken Access Control via Previe -
CVE-2026-57520
Bitwarden Server < 2026.5.0 Privilege Escalation via Bulk Us
Same weakness: CWE-303
-
CVE-2026-49467
TOTP enrollment hijack: password gate skipped due to unawait -
CVE-2026-66411
Hellohas Robotics DEEBOT PRO M1 授权问题漏洞 -
CVE-2026-11430
Grav CMS Scheduler Webhook Authentication Bypass via Null Sh -
CVE-2026-59309
vCenter authentication-bypass vulnerability -
CVE-2026-66028
Ekushey Project Manager CRM 5.0 Missing Uniqueness Constrain
V. Comments for CVE-2026-43640
No comments yet