Vaultwarden SSO Account Takeover: Attacker binds IdP to existing account via unverified email

Vulnerability Overview Title: SSO Email Auto-Link Can Bind an Existing Local Account to an Attacker-Controlled IdP Identity Description: Summary: A vulnerability in Vaultwarden's SSO login flow allows an attacker to bind a victim's email address to their controlled Identity Provider (IdP) identity, enabling authentication as the victim. Root Cause: In the SSO login handler, the claim is only applied in the new user creation branch, but not in the existing user binding branch. This allows an attacker to bind to an existing local account by providing an IdP identity that matches the victim's email address. Impact Scope Affected Versions: All Vaultwarden versions supporting SSO, including 1.35.8 and earlier. Severity: High (7.7/10) CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: Unchanged - Confidentiality: High - Integrity: High - Availability: Low Remediation Fixed Versions: Version 1.36.0 and above have fixed this vulnerability. Fix Details: The patch applies the check to the existing user binding branch, ensuring that SSO login is rejected even if the IdP does not declare . Attack Chain 1. The attacker registers an identity on the configured IdP with an claim matching the victim's Vaultwarden email address. 2. The attacker initiates SSO login to Vaultwarden and authenticates at the IdP using their own identity. 3. The handler fails to find an , falling back to searching by email identifier, which matches the victim's existing local account. 4. If the check is not configured, the process proceeds to the 2FA stage; if the victim has not enabled Vaultwarden 2FA, a session is issued. 5. The new SSO binding links the attacker's IdP principal to the victim's user UUID, granting repeated access. Impact Account Takeover: Attacker can take over SSO-eligible victim accounts without requiring Vaultwarden 2FA. Full Access to Encrypted Data: Complete read access to the victim's encrypted Vault data, including offline brute-forcing of the master password. Authenticated Session Operations: Device registration, emergency access group creation, password modification, and deletion. Privilege Escalation: If the victim holds owner privileges in an organization, this may lead to potential organization-level privilege escalation. Persistence: The SSO binding remains on the victim's account even after the session expires. Prerequisites SSO is enabled on the Vaultwarden instance. is configured (default setting). The victim has an existing Vaultwarden account with an email address that matches an IdP identity obtainable by the attacker, and this account has not previously had an SSO binding. The victim has not enabled Vaultwarden 2FA (2FA prevents the final session issuance but does not prevent the IdP binding attempt). The configured IdP allows registration of identities using the victim's email address. Remediation The patch applies the check to the existing user binding branch, ensuring that SSO login is rejected even if the IdP does not declare . Operator Guidance The fix relies on the IdP correctly reporting . If the IdP cannot strongly enforce email ownership validation, it is recommended to set , requiring explicit action before binding a new SSO identity to an existing local account. References OIDC Core 1.0 Section 5.1 - Claim Semantics Bitwarden Upstream SSO Trust Model: Invite Acceptance Flow in Credits Independent Researchers: @chirpfd (2026-03-22), @Atomics-hub (2026-04-29) --- Note: No POC code or exploit code is included in this advisory.

Goal Reached Thanks to every supporter — we hit 100%!

Vaultwarden SSO Account Takeover: Attacker binds IdP to existing account via unverified email

More from this source