Vulnerability · Published Jun 25, 2026 · Assigned by VulnCheck

CVE-2026-57522Bitwarden Server < 2026.5.0 JSON Injection via Webhook Templates

Low 3.5

In plain English

A low-severity injection in server from bitwarden. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities).

Severity (CVSS 3.1)3.5Low

Exploit odds (30 days)0.5%top 60.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Bitwarden Server before 2026.5.0 contains a JSON injection vulnerability in IntegrationTemplateProcessor.ReplaceTokens(), which substitutes user-controlled values into event-integration templates without JSON encoding. When an organization has configured an event integration whose template references a user-controlled token (such as #ActingUserName# or #UserName#, populated from a member's display name), an authenticated member can set their display name to JSON metacharacters and inject arbitrary key-value pairs into the rendered payloads delivered to webhook, SIEM, Slack, Teams, or Datadog endpoints, making injected fields indistinguishable from legitimate template output.

Affected products (as reported)

Vendor	Product	Versions
bitwarden	server	0 – before 2026.5.0

Weakness: CWE-74 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N

References

https://sanjokkarki.com.np/blog/bitwarden-webhook-json-injection technical-description, exploit
https://github.com/bitwarden/server/releases/tag/v2026.5.0 release-notes
https://github.com/bitwarden/server/pull/7593 issue-tracking
https://github.com/bitwarden/server/commit/a26afd18130ef985ede5c97d277820d045185a28 patch
https://www.vulncheck.com/advisories/bitwarden-server-json-injection-via-webhook-templates third-party-advisory