# CVE-2026-60104: Bitwarden Server authorization bypass in admin-request endpoint

Source: https://junglewise.ai/threats/cve-2026-60104-bitwarden-server-authorization-bypass-in-admin-request-endpoint  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-08. Updated: 2026-07-08  
License: CC BY 4.0 with a link back

CVE-2026-60104 · Severity: high · CVSS 7.3 · Published 2026-07-08

Bitwarden Server, the backend for the popular password management service, was found to have a security flaw in how it handles device encryption requests. A low-privileged member of an organization could trick the system into linking their own encryption keys to another user's account. If an administrator approves this request, the attacker can gain full access to the victim's encrypted vault and take over their account, leading to a total loss of data confidentiality.

## Quick answers

**Is CVE-2026-60104 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-60104 being exploited in the wild.

**How severe is CVE-2026-60104?** High severity, with a CVSS score of 7.3, published 8 July 2026.

**Which products and versions are affected?** Bitwarden Server before 2026.6.0.

**Is there a fix for CVE-2026-60104?** A patch was published on 2026-05-12: Fix merged into main branch via PR #7615 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-60104 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-60104?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Broken Object-Level Authorization (BOLA) vulnerability exists in the 'POST /auth-requests/admin-request' endpoint of Bitwarden Server. The 'AuthRequestService.CreateAuthRequestAsync' method resolves a target user based on a caller-supplied email field in the request body but fails to verify that this email belongs to the authenticated caller. An attacker with low-privileged access can submit a Trusted Device Encryption request containing a victim's email and the attacker's own RSA public key. Once an administrator approves the request, the victim's vault key is re-encrypted to the attacker's public key and made available via an unauthenticated endpoint. This allows the attacker to decrypt the vault key and, by manipulating the request type, obtain a victim-scoped access token for full account takeover. The issue is fixed in version 2026.6.0.

## Affected products

- Bitwarden Server before 2026.6.0

## Timeline

- 2026-05-12: patched: Fix merged into main branch via PR #7615
- 2026-06-10: advisory: Fixed in server release v2026.6.0
- 2026-07-08: disclosed: Public disclosure and CVE assignment

## References

- [https://github.com/bitwarden/server/commit/dcf4c486b2b5bedecc03a48b427243328cc74a9a](https://github.com/bitwarden/server/commit/dcf4c486b2b5bedecc03a48b427243328cc74a9a)
- [https://github.com/bitwarden/server/pull/7615](https://github.com/bitwarden/server/pull/7615)
- [https://github.com/bitwarden/server/releases](https://github.com/bitwarden/server/releases)
- [https://sanjokkarki.com.np/blog/bitwarden-vault-key-heist](https://sanjokkarki.com.np/blog/bitwarden-vault-key-heist)
- [https://www.vulncheck.com/advisories/bitwarden-server-authorization-bypass-via-admin-auth-request](https://www.vulncheck.com/advisories/bitwarden-server-authorization-bypass-via-admin-auth-request)