Is CVE-2026-47159 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-47159 being exploited in the wild.

How severe is CVE-2026-47159?

Informational severity, with a CVSS score of 6.9, published 15 July 2026.

Which products and versions are affected?

Dani-Garcia Vaultwarden < 1.36.0.

Is there a fix for CVE-2026-47159?

A patch was published on 2026-04-29: Fixes merged into main branch via PR #7163 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-47159 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-47159?

Check whether you run Dani-Garcia Vaultwarden at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-47159: Vaultwarden information disclosure in SSO discovery flow

Q: Is there a fix for CVE-2026-47159?

A patch was published on 2026-04-29: Fixes merged into main branch via PR #7163 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-47159 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-47159?

Check whether you run Dani-Garcia Vaultwarden at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-47159 · Severity: info · CVSS 6.9 · Published 2026-07-15

Vaultwarden, an open-source password management server, contained a flaw in its Single Sign-On (SSO) login process. An attacker could use this vulnerability to discover which organizations are registered on the server and potentially interfere with the login process for users. This could lead to unauthorized disclosure of organizational structure and minor disruptions to the authentication workflow.

Technologies: Dani-Garcia Vaultwarden. Vendors: Dani-Garcia.

Quick answers

Is CVE-2026-47159 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-47159 being exploited in the wild.
How severe is CVE-2026-47159?: Informational severity, with a CVSS score of 6.9, published 15 July 2026.
Which products and versions are affected?: Dani-Garcia Vaultwarden < 1.36.0.
Is there a fix for CVE-2026-47159?: A patch was published on 2026-04-29: Fixes merged into main branch via PR #7163 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-47159 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-47159?: Check whether you run Dani-Garcia Vaultwarden at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An information disclosure vulnerability exists in Vaultwarden's SSO discovery and pre-validation flow prior to version 1.36.0. The application incorrectly returned organization-related SSO metadata, including 'organizationIdentifier' values, when queried with arbitrary email addresses. Furthermore, an attacker could obtain a valid pre-validation JSON Web Token (JWT) using only the discovered identifier. This allows unauthenticated remote attackers to enumerate SSO-enabled organizations and potentially abuse the authentication workflow. The issue was addressed by returning dummy identifiers to prevent user and organization enumeration.

Affected products

dani-garcia Vaultwarden < 1.36.0

Timeline

2026-04-29: patched: Fixes merged into main branch via PR #7163
2026-05-03: advisory: Release 1.36.0 published with security fixes
2026-07-15: disclosed: CVE-2026-47159 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.