{"schema_version":1,"title":"Dani-Garcia Vaultwarden vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 11 vulnerabilities in Dani-Garcia Vaultwarden: 1 in the last 7 days and 5 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-95814, was published on 22 September 2026.","url":"https://junglewise.ai/threats/technologies/vaultwarden","json_url":"https://junglewise.ai/threats/technologies/vaultwarden.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/vaultwarden","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","counts":{"high":6,"all_time":11,"critical":0,"exploited":0,"last_7_days":1,"last_30_days":1,"last_90_days":5,"last_365_days":11},"latest":[{"cve":"CVE-2026-95814","cvss":8.1,"epss":0.0043,"slug":"cve-2026-95814-vaultwarden-through-1-37-3-omits-organization-membership-status","title":"Vaultwarden authorization bypass in cipher access queries","severity":"high","exploited":false,"published_at":"2026-09-22T21:17:34.417+00:00","url":"https://junglewise.ai/threats/cve-2026-95814-vaultwarden-through-1-37-3-omits-organization-membership-status"},{"cve":"CVE-2026-47164","cvss":7.7,"slug":"cve-2026-47164-vaultwarden-account-takeover-via-unverified-sso-email-linking","title":"Vaultwarden account takeover via unverified SSO email linking","severity":"high","exploited":false,"published_at":"2026-07-15T16:16:46.63+00:00","url":"https://junglewise.ai/threats/cve-2026-47164-vaultwarden-account-takeover-via-unverified-sso-email-linking"},{"cve":"CVE-2026-47160","cvss":5.8,"slug":"cve-2026-47160-dani-garcia-vaultwarden-ssrf-in-icon-endpoint-via-ip-bypass","title":"dani-garcia Vaultwarden SSRF in icon endpoint via IP bypass","severity":"medium","exploited":false,"published_at":"2026-07-15T16:16:46.49+00:00","url":"https://junglewise.ai/threats/cve-2026-47160-dani-garcia-vaultwarden-ssrf-in-icon-endpoint-via-ip-bypass"},{"cve":"CVE-2026-47159","cvss":6.9,"slug":"cve-2026-47159-vaultwarden-information-disclosure-in-sso-discovery-flow","title":"Vaultwarden information disclosure in SSO discovery flow","severity":"info","exploited":false,"published_at":"2026-07-15T16:16:46.353+00:00","url":"https://junglewise.ai/threats/cve-2026-47159-vaultwarden-information-disclosure-in-sso-discovery-flow"},{"cve":"CVE-2026-47158","cvss":8.3,"slug":"cve-2026-47158-vaultwarden-csrf-and-session-hijacking-in-sso-authorization-flow","title":"Vaultwarden CSRF and session hijacking in SSO authorization flow","severity":"high","exploited":false,"published_at":"2026-07-15T16:16:46.2+00:00","url":"https://junglewise.ai/threats/cve-2026-47158-vaultwarden-csrf-and-session-hijacking-in-sso-authorization-flow"},{"cve":"CVE-2026-43914","cvss":7.3,"slug":"cve-2026-43914-vaultwarden-brute-force-protection-bypass-in-email-2fa-endpoint","title":"Vaultwarden brute-force protection bypass in email 2FA endpoint","severity":"high","exploited":false,"published_at":"2026-05-11T23:20:22.253+00:00","url":"https://junglewise.ai/threats/cve-2026-43914-vaultwarden-brute-force-protection-bypass-in-email-2fa-endpoint"},{"cve":"CVE-2026-43913","cvss":8.1,"slug":"cve-2026-43913-vaultwarden-incorrect-authorization-in-organization-vault-purge","title":"Vaultwarden incorrect authorization in organization vault purge","severity":"high","exploited":false,"published_at":"2026-05-11T23:20:22.12+00:00","url":"https://junglewise.ai/threats/cve-2026-43913-vaultwarden-incorrect-authorization-in-organization-vault-purge"},{"cve":"CVE-2026-43912","cvss":8.7,"epss":0.0003,"slug":"cve-2026-43912-vaultwarden-improper-authorization-in-cross-org-group-binding","title":"Vaultwarden improper authorization in cross-org group binding","severity":"high","exploited":false,"published_at":"2026-05-11T23:20:21.98+00:00","url":"https://junglewise.ai/threats/cve-2026-43912-vaultwarden-improper-authorization-in-cross-org-group-binding"},{"cve":"CVE-2026-43911","cvss":6.8,"epss":0.0003,"slug":"cve-2026-43911-vaultwarden-insufficient-session-expiration-for-refresh-tokens","title":"Vaultwarden insufficient session expiration for refresh tokens","severity":"medium","exploited":false,"published_at":"2026-05-11T23:20:21.837+00:00","url":"https://junglewise.ai/threats/cve-2026-43911-vaultwarden-insufficient-session-expiration-for-refresh-tokens"},{"cve":"CVE-2026-33420","cvss":5.3,"epss":0.0017,"slug":"cve-2026-33420-vaultwarden-missing-authorization-check-in-get-org-collections","title":"Vaultwarden missing authorization check in get_org_collections_details","severity":"medium","exploited":false,"published_at":"2026-05-05T20:16:36.483+00:00","url":"https://junglewise.ai/threats/cve-2026-33420-vaultwarden-missing-authorization-check-in-get-org-collections"},{"cve":"CVE-2026-31835","cvss":5.4,"epss":0.0015,"slug":"cve-2026-31835-vaultwarden-webauthn-backup-flag-tampering-in-validate-webauthn","title":"Vaultwarden WebAuthn backup flag tampering in validate_webauthn_login","severity":"medium","exploited":false,"published_at":"2026-05-05T19:16:21.733+00:00","url":"https://junglewise.ai/threats/cve-2026-31835-vaultwarden-webauthn-backup-flag-tampering-in-validate-webauthn"}],"weekly":[{"week":"2026-06-29","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":4},{"week":"2026-07-20","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":1}],"related":[],"technology":{"hub":true,"name":"Dani-Garcia Vaultwarden","slug":"vaultwarden","vendor":{"name":"Dani-Garcia","slug":"dani-garcia","url":"https://junglewise.ai/threats/vendors/dani-garcia"},"aliases":[],"category":"web-server","homepage":"https://github.com/dani-garcia/vaultwarden","repo_url":"https://github.com/dani-garcia/vaultwarden","description":"Vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as Bitwarden_RS.","url":"https://junglewise.ai/threats/technologies/vaultwarden"},"most_severe":[{"cve":"CVE-2026-43912","cvss":8.7,"epss":0.0003,"slug":"cve-2026-43912-vaultwarden-improper-authorization-in-cross-org-group-binding","title":"Vaultwarden improper authorization in cross-org group binding","severity":"high","exploited":false,"published_at":"2026-05-11T23:20:21.98+00:00","url":"https://junglewise.ai/threats/cve-2026-43912-vaultwarden-improper-authorization-in-cross-org-group-binding"},{"cve":"CVE-2026-47158","cvss":8.3,"slug":"cve-2026-47158-vaultwarden-csrf-and-session-hijacking-in-sso-authorization-flow","title":"Vaultwarden CSRF and session hijacking in SSO authorization flow","severity":"high","exploited":false,"published_at":"2026-07-15T16:16:46.2+00:00","url":"https://junglewise.ai/threats/cve-2026-47158-vaultwarden-csrf-and-session-hijacking-in-sso-authorization-flow"},{"cve":"CVE-2026-95814","cvss":8.1,"epss":0.0043,"slug":"cve-2026-95814-vaultwarden-through-1-37-3-omits-organization-membership-status","title":"Vaultwarden authorization bypass in cipher access queries","severity":"high","exploited":false,"published_at":"2026-09-22T21:17:34.417+00:00","url":"https://junglewise.ai/threats/cve-2026-95814-vaultwarden-through-1-37-3-omits-organization-membership-status"},{"cve":"CVE-2026-43913","cvss":8.1,"slug":"cve-2026-43913-vaultwarden-incorrect-authorization-in-organization-vault-purge","title":"Vaultwarden incorrect authorization in organization vault purge","severity":"high","exploited":false,"published_at":"2026-05-11T23:20:22.12+00:00","url":"https://junglewise.ai/threats/cve-2026-43913-vaultwarden-incorrect-authorization-in-organization-vault-purge"},{"cve":"CVE-2026-47164","cvss":7.7,"slug":"cve-2026-47164-vaultwarden-account-takeover-via-unverified-sso-email-linking","title":"Vaultwarden account takeover via unverified SSO email linking","severity":"high","exploited":false,"published_at":"2026-07-15T16:16:46.63+00:00","url":"https://junglewise.ai/threats/cve-2026-47164-vaultwarden-account-takeover-via-unverified-sso-email-linking"},{"cve":"CVE-2026-43914","cvss":7.3,"slug":"cve-2026-43914-vaultwarden-brute-force-protection-bypass-in-email-2fa-endpoint","title":"Vaultwarden brute-force protection bypass in email 2FA endpoint","severity":"high","exploited":false,"published_at":"2026-05-11T23:20:22.253+00:00","url":"https://junglewise.ai/threats/cve-2026-43914-vaultwarden-brute-force-protection-bypass-in-email-2fa-endpoint"},{"cve":"CVE-2026-43911","cvss":6.8,"epss":0.0003,"slug":"cve-2026-43911-vaultwarden-insufficient-session-expiration-for-refresh-tokens","title":"Vaultwarden insufficient session expiration for refresh tokens","severity":"medium","exploited":false,"published_at":"2026-05-11T23:20:21.837+00:00","url":"https://junglewise.ai/threats/cve-2026-43911-vaultwarden-insufficient-session-expiration-for-refresh-tokens"},{"cve":"CVE-2026-47160","cvss":5.8,"slug":"cve-2026-47160-dani-garcia-vaultwarden-ssrf-in-icon-endpoint-via-ip-bypass","title":"dani-garcia Vaultwarden SSRF in icon endpoint via IP bypass","severity":"medium","exploited":false,"published_at":"2026-07-15T16:16:46.49+00:00","url":"https://junglewise.ai/threats/cve-2026-47160-dani-garcia-vaultwarden-ssrf-in-icon-endpoint-via-ip-bypass"},{"cve":"CVE-2026-31835","cvss":5.4,"epss":0.0015,"slug":"cve-2026-31835-vaultwarden-webauthn-backup-flag-tampering-in-validate-webauthn","title":"Vaultwarden WebAuthn backup flag tampering in validate_webauthn_login","severity":"medium","exploited":false,"published_at":"2026-05-05T19:16:21.733+00:00","url":"https://junglewise.ai/threats/cve-2026-31835-vaultwarden-webauthn-backup-flag-tampering-in-validate-webauthn"},{"cve":"CVE-2026-33420","cvss":5.3,"epss":0.0017,"slug":"cve-2026-33420-vaultwarden-missing-authorization-check-in-get-org-collections","title":"Vaultwarden missing authorization check in get_org_collections_details","severity":"medium","exploited":false,"published_at":"2026-05-05T20:16:36.483+00:00","url":"https://junglewise.ai/threats/cve-2026-33420-vaultwarden-missing-authorization-check-in-get-org-collections"}],"generated_at":"2026-09-26T12:07:00.15149+00:00"}