CVE-2026-60104 – Bitwarden Server
“A single missing ownership check can put an entire account in someone else’s hands.”
Bitwarden has released Bitwarden Server 2026.6.0 to address CVE-2026-60104, an authorization vulnerability (CWE-639) affecting the Trusted Device Encryption authentication workflow. The issue allowed a low-privileged organization member to submit an authentication request using another user’s email address, potentially exposing the victim’s vault key and a victim-scoped access token. Successful exploitation could result in full account takeover.
The CVSS score is 8.7, which is High severity. Public proof-of-concept code is available, increasing the likelihood of exploitation against unpatched deployments. Organizations running Bitwarden Server versions prior to 2026.6.0 should upgrade to the latest release to prevent unauthorized access to user vaults.
Key Details
- Affected Product
- Bitwarden Server
- Attack Vector
- Network
- Attack Complexity
- Low
- Privileges Required
- Low
- User Interaction
- Required
- CWE Classification
- CWE-639