Vulnerabilities in Bitwarden
7 resultsCVE-2026-43639HIGHBitwarden Server < 2026.4.0 Missing Authorization via Provider ClientsEPSS 0.6%CVE-2026-43640HIGHBitwarden Server < 2026.4.1 Authentication Bypass via SCIM API KeyEPSS 0.5%CVE-2026-42994HIGHBitwarden CLI 2026.4.0 from 2026-04-22T21:57Z to 2026-04-22T23:30Z, when obtained from npm, had embedded malicious code. This is related to EPSS 0.3%CVE-2026-43638MEDIUMBitwarden Server < 2026.4.1 Missing Authorization via Organization Cipher ImportEPSS 0.2%CVE-2026-57522LOWBitwarden Server < 2026.5.0 JSON Injection via Webhook TemplatesEPSS —CVE-2026-57520HIGHBitwarden Server < 2026.5.0 Privilege Escalation via Bulk User Remove EndpointEPSS —CVE-2026-57521MEDIUMBitwarden Server < 2026.5.0 Broken Access Control via PreviewInvoiceControllerEPSS —