Executive brief
Vaultwarden, an open-source password management server, contained a flaw in its Single Sign-On (SSO) login process. An attacker could use this vulnerability to discover which organizations are registered on the server and potentially interfere with the login process for users. This could lead to unauthorized disclosure of organizational structure and minor disruptions to the authentication workflow.
Technical details
An information disclosure vulnerability exists in Vaultwarden's SSO discovery and pre-validation flow prior to version 1.36.0. The application incorrectly returned organization-related SSO metadata, including 'organizationIdentifier' values, when queried with arbitrary email addresses. Furthermore, an attacker could obtain a valid pre-validation JSON Web Token (JWT) using only the discovered identifier. This allows unauthenticated remote attackers to enumerate SSO-enabled organizations and potentially abuse the authentication workflow. The issue was addressed by returning dummy identifiers to prevent user and organization enumeration.
Affected products
- dani-garcia Vaultwarden < 1.36.0
Timeline
- 2026-04-29: patched: Fixes merged into main branch via PR #7163
- 2026-05-03: advisory: Release 1.36.0 published with security fixes
- 2026-07-15: disclosed: CVE-2026-47159 published