CVE-2026-43911: Vaultwarden insufficient session expiration for refresh tokens

CVE-2026-43911 · Severity: medium · CVSS 6.8 · Published 2026-05-11

Vaultwarden is an open-source password management server. A security flaw allows an attacker who has previously stolen a session token to maintain access to a user's vault even after the user changes their master password or rotates their security keys. This means that standard security recovery actions taken by a user may fail to actually lock out an unauthorized intruder, potentially leading to long-term unauthorized access to sensitive credentials.

Technologies: Dani-Garcia Vaultwarden. Vendors: Dani-Garcia.

Quick answers

Is CVE-2026-43911 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-43911 being exploited in the wild.
How severe is CVE-2026-43911?
Medium severity, with a CVSS score of 6.8, published 11 May 2026.
Which products and versions are affected?
dani-garcia Vaultwarden <= 1.35.4.
Is there a fix for CVE-2026-43911?
A patch was published on 2026-05-11: Fixed in version 1.35.5 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-43911 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-43911?
Check whether you run Dani-Garcia Vaultwarden. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Vaultwarden (formerly Bitwarden_RS) prior to version 1.35.5 contains a session management vulnerability where refresh tokens are not tied to the user's 'security_stamp'. While access tokens correctly validate the security stamp on every request, the refresh token flow in 'src/auth.rs' only verifies the existence of a 'Device' record and does not check if the security stamp has been rotated. Consequently, operations that reset the security stamp—such as password changes, KDF setting updates, encryption key rotations, and email changes—do not invalidate existing refresh tokens. An attacker with a valid refresh token can continue to generate new access tokens indefinitely unless the user manually triggers a 'Deauthorize Sessions' action, which explicitly deletes the device records.

Affected products

  • dani-garcia Vaultwarden <= 1.35.4

Timeline

  • 2026-04-25: advisory: Original GitHub security advisory published
  • 2026-05-11: disclosed: CVE published to NVD
  • 2026-05-11: patched: Fixed in version 1.35.5

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.