# CVE-2026-101878: Bitwarden Server authentication bypass via SSO identifier truncation

Source: https://junglewise.ai/threats/cve-2026-101878-bitwarden-server-2025-6-0-before-2026-5-0-declares-the  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-29. Updated: 2026-09-29  
License: CC BY 4.0 with a link back

CVE-2026-101878 · Severity: high · CVSS 7.5 · Published 2026-09-29

Bitwarden Server, a password manager and secrets management platform, contains a flaw in how it processes Single Sign-On (SSO) login identifiers on SQL Server deployments. An attacker whose SSO identity begins with another organization member's full 50-character identifier can authenticate as that member and steal their access credentials and secrets. This allows account takeover and unauthorized access to sensitive data.

Vendors: [Bitwarden](https://junglewise.ai/threats/vendors/bitwarden).

## Quick answers

**Is CVE-2026-101878 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-101878 being exploited in the wild.

**How severe is CVE-2026-101878?** High severity, with a CVSS score of 7.5, published 29 September 2026.

**Which products and versions are affected?** Bitwarden Server 2025.6.0 before 2026.5.0.

**Is there a fix for CVE-2026-101878?** A patch was published on 2026-04-23: Fix merged in PR #7501 on April 29, 2026 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-101878 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-101878?** Check whether you run Bitwarden Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The User_ReadBySsoUserOrganizationIdExternalId stored procedure declares the @ExternalId parameter as NVARCHAR(50) while the underlying database column stores NVARCHAR(300), causing silent truncation of SSO identifiers on SQL Server. An attacker whose provider identifier begins with another user's truncated 50-character identifier can match during authentication, bypassing identity validation. The vulnerability requires SSO-based authentication and organization membership but no user interaction beyond login.

## Affected products

- Bitwarden Server 2025.6.0 before 2026.5.0

## Timeline

- 2026-09-29: disclosed
- 2026-04-23: patched: Fix merged in PR #7501 on April 29, 2026
- 2026-09-29: advisory: CVE-2026-101878

## References

- [https://github.com/bitwarden/server/commit/27ae3d5455f723975fac03819eaeba8710666bc4](https://github.com/bitwarden/server/commit/27ae3d5455f723975fac03819eaeba8710666bc4)
- [https://github.com/bitwarden/server/pull/7501](https://github.com/bitwarden/server/pull/7501)

## Related threats

- [Bitwarden Server authorization bypass in cipher creation](https://junglewise.ai/threats/cve-2026-119414-bitwarden-server-before-2026-10-1-on-entity-framework-backends)