Junglewise Threat Intelligence

CVE-2026-60104: Bitwarden Server authorization bypass in admin-request endpoint

CVE-2026-60104 · Severity: high · CVSS 7.3 · Published 2026-07-08

Technologies: Bitwarden Server.

Executive brief

Bitwarden Server, the backend for the popular password management service, was found to have a security flaw in how it handles device encryption requests. A low-privileged member of an organization could trick the system into linking their own encryption keys to another user's account. If an administrator approves this request, the attacker can gain full access to the victim's encrypted vault and take over their account, leading to a total loss of data confidentiality.

Technical details

A Broken Object-Level Authorization (BOLA) vulnerability exists in the 'POST /auth-requests/admin-request' endpoint of Bitwarden Server. The 'AuthRequestService.CreateAuthRequestAsync' method resolves a target user based on a caller-supplied email field in the request body but fails to verify that this email belongs to the authenticated caller. An attacker with low-privileged access can submit a Trusted Device Encryption request containing a victim's email and the attacker's own RSA public key. Once an administrator approves the request, the victim's vault key is re-encrypted to the attacker's public key and made available via an unauthenticated endpoint. This allows the attacker to decrypt the vault key and, by manipulating the request type, obtain a victim-scoped access token for full account takeover. The issue is fixed in version 2026.6.0.

Affected products

  • Bitwarden Server before 2026.6.0

Timeline

  • 2026-05-12: patched: Fix merged into main branch via PR #7615
  • 2026-06-10: advisory: Fixed in server release v2026.6.0
  • 2026-07-08: disclosed: Public disclosure and CVE assignment

References