CVE Feed

    Dashboard / CVE / CVE-2026-101878

    CVE-2026-101878

    Bitwarden Server 2025.6.0 before 2026.5.0 declares the @ExternalId parameter of the User_ReadBySsoUserOrganizationIdExternalId stored procedure as NVARCHAR(50) while the column it queries stores NVARCHAR(300), silently truncating the SSO login identifier on SQL Server deployments and allowing a user whose identity-provider identifier begins with another organization member's full 50-character identifier to authenticate as that member and obtain a victim-scoped access token.

    Published:Sep 29, 2026
    Last Modified:Oct 1, 2026
    EPS:Sep 29, 2026
    EPSS Score:0.00258
    CVSS Score:7.5

    Affected Products

    Vendor
    Bitwarden
    Product
    Bitwarden
    Vendor
    Bitwarden
    Product
    Server

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-90 Reflection Attack in Authentication Protocol

    Related CVEs

    CVE-2026-42994 (CVSS 8.8) — Bitwarden CLI 2026.4.0 from 2026-04-22T21:57Z to 2026-04-22T23:30Z, when obtained from npm, had embedded malic…
    CVE-2025-5138 (CVSS 2) — A vulnerability was found in Bitwarden up to 2.25.1. It has been declared as problematic. Affected by this vul…
    CVE-2023-38840 (CVSS 5.5) — Bitwarden Desktop 2023.7.0 and below allows an attacker with local access to obtain sensitive information via …
    CVE-2023-27706 (CVSS 7.1) — Bitwarden Windows desktop application versions prior to v2023.4.0 store biometric keys in Windows Credential M…
    CVE-2023-27974 (CVSS 7.5) — Bitwarden through 2023.2.1 offers password auto-fill when the second-level domain matches, e.g., a password st…
    CVE-2018-25081 (CVSS 7.5) — Bitwarden through 2023.2.1 offers password auto-fill within a cross-domain IFRAME element. NOTE: the vendor's …

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High