Vendor

    Bitwarden

    17 known vulnerabilities in products by Bitwarden, 0 of them actively exploited (CISA KEV).

    Key figures

    17

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    3

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in Bitwarden
    HighCVE-2020-15879

    Bitwarden Server: Server-Side Request Forgery (SSRF)

    		7.5
    CriticalCVE-2026-43639

    Bitwarden Server < 2026.4.0 Missing Authorization via Provider Clients

    		9.1
    HighCVE-2019-19766

    Bitwarden Server: security vulnerability

    		7.5
    HighCVE-2026-57520

    Bitwarden Server < 2026.5.0 Privilege Escalation via Bulk User Remove Endpoint

    also in 1 other product

    		7.1
    HighCVE-2026-43640

    Bitwarden Server < 2026.4.1 Authentication Bypass via SCIM API Key

    		8.1
    CriticalCVE-2026-60104

    Bitwarden Server < 2026.6.0 Authorization Bypass via Admin Auth Request

    also in 1 other product

    		8.0
    HighCVE-2018-25081

    Bitwarden: security vulnerability

    		7.5
    HighCVE-2023-27974

    Bitwarden: security vulnerability

    		7.5
    MediumCVE-2026-71959

    Bitwarden Server < 2026.7.2 Audit Log Injection via POST /collect

    also in 1 other product

    		5.8
    HighCVE-2026-101878

    Bitwarden Server 2025.6.0 < 2025.6.0 Authentication Bypass via SSO Identifier Truncation

    also in 1 other product

    		7.5
    CriticalCVE-2026-42994

    Bitwarden CLI: OS Command Injection

    		9.8
    MediumCVE-2026-57521

    Bitwarden Server < 2026.5.0 Broken Access Control via PreviewInvoiceController

    also in 1 other product

    		4.3
    MediumCVE-2026-57522

    Bitwarden Server < 2026.5.0 JSON Injection via Webhook Templates

    also in 1 other product

    		5.0
    HighCVE-2023-27706

    Bitwarden: security vulnerability

    		7.1
    MediumCVE-2026-119414

    Bitwarden Server before 2026.10.1 Authorization Bypass via POST /api/ciphers/create

    		4.3
    MediumCVE-2023-38840

    Bitwarden: Information Disclosure

    		5.5
    MediumCVE-2026-43638

    Bitwarden Server < 2026.4.1 Missing Authorization via Organization Cipher Import

    		5.4

    News

    Products

    Products by Bitwarden
    Bitwarden Server100
    Bitwarden40