What’s Vulnerable › Products

dani-garcia vaultwarden vulnerabilities

26 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 23 published in the last 12 months.

Check whether your dani-garcia vaultwarden version is affected

Latest dani-garcia vaultwarden vulnerabilities

• CVE-2026-116678 — Vaultwarden: Icon endpoint SSRF fix bypass via second-stage favicon IP literal URLs (CVSS 5.8)
• CVE-2026-95814 — Vaultwarden through 1.37.3 Authorization Bypass via Missing Status Check (CVSS 8.1)
• CVE-2026-47164 — Vaultwarden: SSO Email Auto-Link Can Bind an Existing Local Account to an Attacker-Controlled IdP Identity (CVSS 7.7)
• CVE-2026-47160 — Vaultwarden: Server-side request forgery (SSRF) via Icon Endpoint Decimal/Hex/Octal IP Bypass (CVSS 5.8)
• CVE-2026-47159 — Vaultwarden: Authentication Flow Information Disclosure in SSO Discovery Allows Organization Enumeration and Pre-Validation Token Exposure (CVSS 6.9)
• CVE-2026-47158 — Vaultwarden: CSRF in SSO Authorization Flow (CVSS 8.3)
• CVE-2026-43914 — Vaultwarden: Brute-force protection bypass vulnerability (CVSS 9.8)
• CVE-2026-43913 — Vaultwarden: Unconfirmed Owner Can Purge Entire Organization Vault (CVSS 8.1)
• CVE-2026-43912 — Vaultwarden: Cross-Org Group Binding Enables Unauthorized Read And Write Access Into Another Organization (CVSS 8.7)
• CVE-2026-43911 — Vaultwarden: Refresh tokens not invalidated on security stamp rotation (CVSS 8.1)
• CVE-2026-33420 — Vaultwarden missing authorization check allows Manager-role users to enumerate all collections (CVSS 5.3)
• CVE-2026-31835 — Vaultwarden WebAuthn credential metadata tampered before signature verification (CVSS 5.4)
• CVE-2026-27898 — Vaultwarden: Unauthorized Access via Partial Update API on Another User’s Cipher (CVSS 5.4)
• CVE-2026-27803 — Vaultwarden: Collection Management Operations Allowed Without `manage` Verification for Manager Role (CVSS 8.3)
• CVE-2026-27802 — Vaultwarden: Privilege Escalation via Bulk Permission Update to Unauthorized Collections by Manager (CVSS 8.3)
• CVE-2026-27801 — Vaultwarden: 2FA Bypass on Protected Actions due to Faulty Rate Limit Enforcement (CVSS 5.9)
• CVE-2026-26012 — vaultwarden has Full Cipher Enumeration Ignoring Organization Collection Permissions (CVSS 6.5)
• CVE-2025-24365 — vaultwarden allows escalation of privilege via variable confusion in OrgHeaders trait (CVSS 7.5)
• CVE-2025-24364 — vaultwarden allows RCE in the admin panel (CVSS 7.2)
• CVE-2024-55226 — (CVSS 5.4)
• CVE-2024-55225 — (CVSS 9.8)
• CVE-2024-55224 — (CVSS 9.6)
• CVE-2024-56335 — Privilege escalation allows organization groups to be updated/deleted if their UUID is known in vaultwarden (CVSS 7.5)
• CVE-2024-39926 — (CVSS 5.4)
• CVE-2024-39925 — (CVSS 6.5)