← back
CVE-2026-43640

Bitwarden Server < 2026.4.1 Authentication Bypass via SCIM API Key

CVSS 8.6 HIGHEPSS 0.5%CWE-303
Bitwarden Server prior to v2026.4.1 does not require master-password re-authentication when retrieving or rotating an organization's SCIM API key, allowing an authenticated user with SCIM management privileges to obtain the key using only a valid session.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Affected products
bitwarden · server
public PoCs found — 1
cve_referencesanjokkarki.com.np/blog/bitwarden-scim-key-bypassunverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →
References
https://github.com/bitwarden/server/commit/eb251d9bf80724c87b187661783b9354d1784083https://github.com/bitwarden/server/pull/7403https://github.com/bitwarden/server/releases/tag/v2026.4.1https://sanjokkarki.com.np/blog/bitwarden-scim-key-bypasshttps://www.vulncheck.com/advisories/bitwarden-server-authentication-bypass-via-scim-api-key