Executive brief
Vaultwarden is an open-source password management server. A security flaw allows an attacker who has previously stolen a session token to maintain access to a user's vault even after the user changes their master password or rotates their security keys. This means that standard security recovery actions taken by a user may fail to actually lock out an unauthorized intruder, potentially leading to long-term unauthorized access to sensitive credentials.
Technical details
Vaultwarden (formerly Bitwarden_RS) prior to version 1.35.5 contains a session management vulnerability where refresh tokens are not tied to the user's 'security_stamp'. While access tokens correctly validate the security stamp on every request, the refresh token flow in 'src/auth.rs' only verifies the existence of a 'Device' record and does not check if the security stamp has been rotated. Consequently, operations that reset the security stamp—such as password changes, KDF setting updates, encryption key rotations, and email changes—do not invalidate existing refresh tokens. An attacker with a valid refresh token can continue to generate new access tokens indefinitely unless the user manually triggers a 'Deauthorize Sessions' action, which explicitly deletes the device records.
Affected products
- dani-garcia Vaultwarden <= 1.35.4
Timeline
- 2026-04-25: advisory: Original GitHub security advisory published
- 2026-05-11: disclosed: CVE published to NVD
- 2026-05-11: patched: Fixed in version 1.35.5