Vaultwarden 1.36.0 Security Bulletin: Fix for SSO CSRF, Enumeration, SSO Binding, and SSRP

Vulnerability Overview The provided webpage screenshot displays the release notes for Vaultwarden version 1.36.0, which includes several security fixes. These fixes address the following security vulnerabilities: 1. SSO Login CSRF - Vulnerability IDs: GHSA-p5p2-jhqq-6hp5, GHSA-w6h6-8r66-hcv7 2. User/Organization Enumeration - Vulnerability ID: GHSA-hxqh-f5p-w4f3 3. SSO Existing-User Binding - Vulnerability IDs: GHSA-r4jg-gpvi-7fgr, GHSA-6x5c-84vm-5d56 4. SSRP via Icon Endpoint - Vulnerability ID: GHSA-72vh-5j9g-m82g Impact Scope These vulnerabilities may affect users of Vaultwarden, particularly those who have Single Sign-On (SSO) enabled. Specific impacts include: CSRF Attacks: May lead to unauthorized access to user accounts. User/Organization Enumeration: Attackers may exploit enumeration of user or organization information to obtain sensitive data. SSO User Binding Issues: May result in user accounts being incorrectly bound or hijacked. SSRP Attacks: SSRP attacks initiated via the icon endpoint may lead to the leakage of internal network information. Remediation 1. Update Version: Users are strongly advised to update to version 1.36.0 as soon as possible to patch the aforementioned security vulnerabilities. 2. Follow Best Practices: - Ensure SSO configuration is correct to prevent CSRF attacks. - Restrict access privileges for user/organization enumeration. - Review and fix SSO user binding logic. - Harden the icon endpoint against SSRP attacks. Additional Information Archiving Feature: Added functionality to archive items. See the blog post and admin documentation for details. Web Vault Update: Web Vault has been updated to v2026.4.1. Contributors New contributors include: @matt-aaron, @Shocker, @xjohnyknox, @mango766, @ISSOtM. Full Changelog Link to full changelog: 1.35.0...1.36.0 Discussion This release can be discussed here. Contributor Avatars Avatars of some contributors are displayed, including Timshe1, stefan0xC, among others. Reactions A total of 143 reactions were made to this release. --- The above summarizes the security fixes for Vaultwarden version 1.36.0. Users are recommended to update promptly to ensure system security.

Goal Reached Thanks to every supporter — we hit 100%!

Vaultwarden 1.36.0 Security Bulletin: Fix for SSO CSRF, Enumeration, SSO Binding, and SSRP

More from this source