CVE-2023-27706

Severity: high (CVSS 7.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2023-06-09 · updated 2026-06-17
Weakness: CWE-312

Description

Bitwarden Windows desktop application versions prior to v2023.4.0 store biometric keys in Windows Credential Manager, accessible to other local unprivileged processes.

Affected products

Bitwarden: before 2023.4.0 — fixed in 2023.4.0

How to fix

Upgrade to a fixed version: Bitwarden 2023.4.0. Check the vendor advisory for mitigations.

References

https://github.com/bitwarden/clients
https://github.com/bitwarden/clients/blob/8b5a223ad4ca0f89b6c9bcdbddef464d1755d2c0/apps/desktop/desktop_native/src/biometric/windows.rs#L19
https://github.com/bitwarden/clients/blob/8b5a223ad4ca0f89b6c9bcdbddef464d1755d2c0/apps/desktop/desktop_native/src/password/windows.rs#L16
https://hackerone.com/reports/1874155
https://github.com/bitwarden/clients
https://github.com/bitwarden/clients/blob/8b5a223ad4ca0f89b6c9bcdbddef464d1755d2c0/apps/desktop/desktop_native/src/biometric/windows.rs#L19
https://github.com/bitwarden/clients/blob/8b5a223ad4ca0f89b6c9bcdbddef464d1755d2c0/apps/desktop/desktop_native/src/password/windows.rs#L16
https://hackerone.com/reports/1874155

Get alerted when CVE-2023-27706 or the next vulnerability affects your stack