Vaultwarden

A vulnerability in Vaultwarden allows attackers with admin rights in one organization to modify or delete groups in other organizations if they know the relevant UUIDs. This can lead to denial of service or privilege escalation.

A vulnerability in Vaultwarden allows attackers to gain administrator privileges in foreign organizations by manipulating URL parameters while exploiting their own organization rights.

A vulnerability in Vaultwarden allows attackers with admin access to execute arbitrary code on the server by manipulating configuration settings and uploading specially crafted files.

A vulnerability in Vaultwarden allows attackers to modify administrator settings without authorization through malicious web pages when the DISABLE_ADMIN_TOKEN option is enabled.

Vaultwarden password manager up to version 1.34.3 has a two-factor authentication flaw that allows attackers with account access to bypass the six-digit one-time code through repeated attempts and perform protected actions like account deletion.

A vulnerability in Vaultwarden allows organization members to retrieve all encrypted passwords and data from the organization, even when they should not have access to certain collections.

A vulnerability in Vaultwarden allows Manager accounts to escalate their privileges and gain unauthorized access to collections not originally assigned to them by exploiting a specific API function.

Vaultwarden password manager allows users with Manager role to edit and delete collections even when their permission to manage them is explicitly disabled, potentially leading to unauthorized access and data loss.

A vulnerability in Vaultwarden allows authenticated users to retrieve encrypted password data and attachments belonging to other users through a flawed API endpoint, even though they lack proper authorization.

A vulnerability in Vaultwarden's SSO login allowed attackers to take over other users' accounts by tricking victims into authenticating through an attacker-controlled login process.

An authorization flaw in Vaultwarden allows managers with restricted permissions to view names and assignments of all collections in their organization, even though they should only access specific collections assigned to them.

A vulnerability in Vaultwarden allows attackers with password access to permanently corrupt WebAuthn credentials by sending fake authentication data that gets processed before signature verification, potentially causing permanent denial of two-factor authentication service.

A vulnerability in Vaultwarden allows attackers to discover which organizations use SSO by submitting arbitrary email addresses, then obtain valid authentication tokens without proving identity ownership.

A security vulnerability in Vaultwarden allows attackers to maintain account access using old refresh tokens even after users perform security-sensitive actions like password changes.

A vulnerability in Vaultwarden allowed attackers to impersonate other users by registering an identity with the victim's email address at an Identity Provider and exploiting insufficient email verification in the SSO login process.

Vaultwarden, a password manager, fails to properly verify that groups and users belong to the same organization, allowing administrators of one organization to gain unauthorized access to passwords and data from other organizations.

A security vulnerability in Vaultwarden allows invited organization owners to delete the entire organization vault before their invitation is confirmed by existing owners, potentially causing immediate data loss.

Vaultwarden before version 1.35.4 has a vulnerability that allows attackers to bypass brute-force protection when email 2FA is enabled, enabling password guessing without rate limiting.

Vaultwarden, a password manager, has a vulnerability in its icon fetching feature that allows attackers to send HTTP requests to internal servers by using IP addresses in alternative formats (decimal, hexadecimal) to bypass security filters.

Critical security fixes for SSO CSRF, user enumeration, SSRF and other vulnerabilities plus new item archiving feature

Bug fixes for master password policies, recovery codes, refresh token responses and DNS issues along with updates for Rust, dependencies and web vault

Fixes an issue with two-factor authentication on Android devices

Critical security fixes for organization management and token invalidation, admin templates changed, 2FA tokens limited to 30 days

Fixes critical bug in two-factor authentication where remember tokens and recovery tokens were not accepted

Security update fixes critical vulnerabilities in cipher access and organization permissions

Security update fixes critical vulnerability allowing authenticated attackers to access organization collections they don't belong to

Fixes critical organization creation bug in web-vault and improves Android compatibility and SSO functionality

Fixes logout issue after upgrade caused by refresh token parsing error and updates web vault to version 2025.12.1

Vaultwarden 1.35.0 introduces OpenID Connect SSO support, updates web vault to 2025.12.0, and fixes various bugs in multi-select push and WebAuthn functionality

Fixes MySQL/MariaDB connection issues in Alpine images by downgrading to MariaDB Connector/C v3.4.5

Vaultwarden 1.34.2 updates web vault to 2025.7.0, adds experimental S3 support and fixes various issues with passkeys, password policies and Yubico keys

Vaultwarden 1.34.0 introduces new registration flow with email verification, fixes CVE-2025-25188, and adds feature flags for mTLS and attachment export

Fixes a crash in the admin diagnostics functionality

Security update with CVE fix, workflow improvements and bug fixes for icon redirects and collection management

Bugfix release with corrections for desktop client icons, invitations, DUO settings, manager rights and mobile client synchronization

Security update fixes critical vulnerability when ORG_GROUPS_ENABLED setting is enabled and includes additional optimizations

Bug fixes for push notifications, member management and sync issues with native clients plus backend admin updates

Security update with CVE fixes, SSH key support for desktop clients and various bug fixes

Security update fixes multiple CVE vulnerabilities and improves mobile app compatibility

Bug fixes for email invitations, SMTP issues with certain providers, iOS synchronization and collection management

Bug fixes for collection management, Windows compilation and version parameter

Bugfix release with fixes for mobile client synchronization, new SQLite backup CLI option and email template improvements

Security update with fixes for three CVE vulnerabilities, web-vault update and various bug fixes

Bug fix for web API call compatibility with jQuery 3.7.1