Vulnerability · Published Jul 8, 2026 · Assigned by VulnCheck

CVE-2026-60104Bitwarden Server < 2026.6.0 Authorization Bypass via Admin Auth Request

High 8.7

In plain English

A high-severity authorization bypass via user-controlled key in server from bitwarden. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities).

Severity (CVSS 3.1)8.7High

Exploit odds (30 days)0.4%top 68.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Bitwarden Server before 2026.6.0 does not verify that the email in a POST /auth-requests/admin-request body belongs to the authenticated caller, allowing a low-privileged organization member to obtain another user's vault key and a victim-scoped access token by creating a Trusted Device Encryption authentication request, bound to an attacker-controlled public key, that is readable from an unauthenticated endpoint once approved resulting in disclosure of the victim's vault key and account takeover.

Affected products (as reported)

Vendor	Product	Versions
bitwarden	server	0 – before 2026.6.0

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

References

Researcher Disclosure technical-description, exploit
Release Notes release-notes
Fix PR issue-tracking
Fix Commit patch
https://www.vulncheck.com/advisories/bitwarden-server-authorization-bypass-via-admin-auth-request third-party-advisory