CVE-2026-43640
HIGH
8,6
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: low
User Interaction: none
Confidentiality: N/A
Integrity: N/A
Availability: N/A
HIGH
8,1
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: low
User Interaction: none
Scope: unchanged
Confidentiality: high
Integrity: high
Availability: none
Description
AI Translation Available
Bitwarden Server prior to v2026.4.1 does not require master-password re-authentication when retrieving or rotating an organization's SCIM API key, allowing an authenticated user with SCIM management privileges to obtain the key using only a valid session.
303
Incorrect Implementation of Authentication Algorithm
DraftCommon Consequences
Security Scopes Affected:
Access Control
Potential Impacts:
Bypass Protection Mechanism
Applicable Platforms
All platforms may be affected
https://github.com/bitwarden/server/commit/eb251d9bf80724c87b187661783b9354d178…
https://github.com/bitwarden/server/pull/7403
https://github.com/bitwarden/server/releases/tag/v2026.4.1
https://sanjokkarki.com.np/blog/bitwarden-scim-key-bypass
https://www.vulncheck.com/advisories/bitwarden-server-authentication-bypass-via…