What’s Vulnerable › Products

bitwarden server vulnerabilities

10 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 8 published in the last 12 months.

Check whether your bitwarden server version is affected

Latest bitwarden server vulnerabilities

• CVE-2026-71959 — Bitwarden Server < 2026.7.2 Audit Log Injection via POST /collect (CVSS 5.8)
• CVE-2026-60104 — Bitwarden Server < 2026.6.0 Authorization Bypass via Admin Auth Request (CVSS 8.0)
• CVE-2026-57522 — Bitwarden Server < 2026.5.0 JSON Injection via Webhook Templates (CVSS 5.0)
• CVE-2026-57521 — Bitwarden Server < 2026.5.0 Broken Access Control via PreviewInvoiceController (CVSS 4.3)
• CVE-2026-57520 — Bitwarden Server < 2026.5.0 Privilege Escalation via Bulk User Remove Endpoint (CVSS 7.1)
• CVE-2026-43640 — Bitwarden Server < 2026.4.1 Authentication Bypass via SCIM API Key (CVSS 8.1)
• CVE-2026-43639 — Bitwarden Server < 2026.4.0 Missing Authorization via Provider Clients (CVSS 9.1)
• CVE-2026-43638 — Bitwarden Server < 2026.4.1 Missing Authorization via Organization Cipher Import (CVSS 5.4)
• CVE-2020-15879 — (CVSS 7.5)
• CVE-2019-19766 — (CVSS 7.5)