Executive brief
Vaultwarden authenticated reflected cross-site scripting (XSS) vulnerability
Affected products
- crates.io vaultwarden
Junglewise Threat Intelligence
CVE-2024-55226: Vaultwarden authenticated reflected cross-site scripting (XSS) vulnerability
CVE-2024-55226 · Severity: medium · CVSS 4 · Published 2025-01-09
Technologies: vaultwarden (crates.io). Vendors: crates.io.
Related threats
- Vaultwarden has Unauthorized Access via Partial Update API on Another User’s Cipher
- Vaultwarden's Collection Management Operations Allowed Without `manage` Verification for Manager Role
- Vaultwarden has Privilege Escalation via Bulk Permission Update to Unauthorized Collections by Manager
- Vaultwarden has 2FA Bypass on Protected Actions due to Faulty Rate Limit Enforcement
- Vaultwarden HTML injection vulnerability