Bitwarden Server AuthRequest Bypass Vulnerability (CVE-2026-60104) Analysis and POC

Vulnerability Overview The endpoint in Bitwarden contains a vulnerability that allows a low-privilege member to take over another member's Vault. This vulnerability enables an attacker to construct specific requests to obtain the victim's encryption keys and use them to decrypt the victim's entire Vault. Scope of Impact Affected Product: Bitwarden/server Severity: High (CVSS 8.7) CVE: CVE-2026-60104 Report: HackerOne #3676230 Fix: PR #7615 - commit (PM-35401) Fixed Version: server release (2026-06-10) Remediation 1. Fix Code: - In the method, add a check for to ensure the request type is . - Add a check for to ensure the email in the request matches the email of the currently authenticated user. 2. Remediation Steps: - In the method, add a check for to ensure the request type is . - Add a check for to ensure the email in the request matches the email of the currently authenticated user. POC Code Path A - Key Leakage (Original Report) 1. The attacker authenticates using their own low-privilege custom credentials. 2. The attacker generates a one-time RSA-2048 key pair. 3. The attacker POSTs an containing the victim's email and their public key. 4. In the organization's device approval panel, the request appears as , indistinguishable from a real user. The owner/admin approves it. 5. The attacker retrieves the result without the header. 6. The attacker decrypts the key using their private key via RSA-OAEP, obtaining the victim's original 64-byte Vault key. Path B - Missing Link (Full Session, Attacker Credentials Only) 1. The attacker authenticates using their own low-privilege custom credentials. 2. The attacker captures the victim's device ID (via SignalR). 3. The attacker generates an RSA-2048 key pair. 4. The attacker POSTs an containing the victim's email and their public key. 5. The victim approves the login push. 6. The attacker retrieves the result without the header. 7. The attacker decrypts the key using their private key via RSA-OAEP, obtaining the victim's original 64-byte Vault key. 8. The attacker POSTs to , using the victim's device ID and their access code. 9. The attacker uses the victim's access token to GET , decrypting the entire Vault. Disclosure Timeline 2026-04-15: Reported to HackerOne (#3676230) 2026-04-16: Bitwarden confirmed BOLA and unauthenticated key leakage 2026-04-17: Demonstrated Path B: The endpoint did not enforce request types, allowing an to be exchanged for to obtain a victim-scoped session 2026-04-20: Classified and routed to the engineering team 2026-05-21: Fix merged into (PR #7615, commit ) 2026-06-10: Released in server version 2026-06-26: Resolved and bounty awarded 2026-07-08: Public write-up 2026-07-09: CVE-2026-60104 assigned to VulnCheck (CNA) Lessons Learned Two identities in one handler is a BOLA waiting to happen: One from the token, one from the principal. If the code does not assert they are equal, the attacker will make them disagree. An endpoint that does not pin the request type inherits all other types' privileges: was designed for , but it silently accepted , a different, more dangerous state machine that ultimately leads to a manageable session token. A stolen key is only half of the compromise: You also need the ciphertext. An encryption key and encrypted data unlock usually reside behind separate access checks, so leaking a key does not automatically leak data. This became a complete takeover because the second vulnerability—the unpinned request type—also produced a victim-scoped session to obtain the data. Always trace all paths of the key to plaintext; it may mean nothing on its own. Approval wipes out attacker inputs: A human clicks "approve" to re-encrypt to whatever public key was sent along with the request. They see the victim's email and trust it; they never see the swapped key. Special thanks to @mandreko-bitwarden and the Bitwarden security team for their assistance in vulnerability remediation and fixes. — @thesanjok

Goal Reached Thanks to every supporter — we hit 100%!

Bitwarden Server AuthRequest Bypass Vulnerability (CVE-2026-60104) Analysis and POC