dani-garcia (Daniel Garcia) Vaultwarden

An issue in the component src/api/identity.rs of Vaultwarden prior to v1.32.5 allows attackers to impersonate users, including Administrators, via a crafted authorization request.

Vaultwarden: Brute-force protection bypass vulnerability

An HTML injection vulnerability in Vaultwarden prior to v1.32.5 allows attackers to execute arbitrary code via injecting a crafted payload into the username field of an e-mail message.

An issue was discovered in Vaultwarden (formerly Bitwarden_RS) 1.30.3. A vulnerability has been identified in the authentication and authorization process of the endpoint responsible for altering the metadata of an emergency access. It permits an attacker with granted emergency access to escalate their privileges by changing the access level and modifying the wait time. Consequently, the attacker can gain full control over the vault (when only intended to have read access) while bypassing the necessary wait period.

Vaultwarden: Cross-Org Group Binding Enables Unauthorized Read And Write Access Into Another Organization

Vaultwarden: Privilege Escalation via Bulk Permission Update to Unauthorized Collections by Manager

Vaultwarden: Collection Management Operations Allowed Without `manage` Verification for Manager Role

vaultwarden allows escalation of privilege via variable confusion in OrgHeaders trait

Vaultwarden: Unconfirmed Owner Can Purge Entire Organization Vault

Vaultwarden: Refresh tokens not invalidated on security stamp rotation

Privilege escalation allows organization groups to be updated/deleted if their UUID is known in vaultwarden

vaultwarden allows RCE in the admin panel

An issue was discovered in Vaultwarden (formerly Bitwarden_RS) 1.30.3. It lacks an offboarding process for members who leave an organization. As a result, the shared organization key is not rotated when a member departs. Consequently, the departing member, whose access should be revoked, retains a copy of the organization key. Additionally, the application fails to adequately protect some encrypted data stored on the server. Consequently, an authenticated user could gain unauthorized access to encrypted data of any organization, even if the user is not a member of the targeted organization. However, the user would need to know the corresponding organizationId. Hence, if a user (whose access to an organization has been revoked) already possesses the organization key, that user could use the key to decrypt the leaked data.

vaultwarden has Full Cipher Enumeration Ignoring Organization Collection Permissions

Vaultwarden: 2FA Bypass on Protected Actions due to Faulty Rate Limit Enforcement

An issue was discovered in Vaultwarden (formerly Bitwarden_RS) 1.30.3. A stored cross-site scripting (XSS) or, due to the default CSP, HTML injection vulnerability has been discovered in the admin dashboard. This potentially allows an authenticated attacker to inject malicious code into the dashboard, which is then executed or rendered in the context of an administrator's browser when viewing the injected content. However, it is important to note that the default Content Security Policy (CSP) of the application blocks most exploitation paths, significantly mitigating the potential impact.

Vaultwarden v1.32.5 was discovered to contain an authenticated reflected cross-site scripting (XSS) vulnerability via the component /api/core/mod.rs.

Vaultwarden: Unauthorized Access via Partial Update API on Another User’s Cipher

Vaultwarden WebAuthn credential metadata tampered before signature verification

Vaultwarden missing authorization check allows Manager-role users to enumerate all collections