汇总 bitwarden 相关全部产品的 CVE 与安全漏洞情报，包括 CVSS、EPSS、公开时间与漏洞情报数据。
常见弱点模式包括 SSRF与路径处理缺陷，在 生产负载与软件部署 使用场景中可能带来 文件覆盖 等风险。
相关漏洞数据主要来源于公开漏洞披露与安全公告，可用于评估历史漏洞暴露面与修复优先级。
| CVE | 摘要 | 来源 | 最高 CVSS | EPSS % | 公开时间 | 更新时间 |
|---|---|---|---|---|---|---|
| CVE-2026-57522 | Bitwarden Server before 2026.5.0 contains a JSON injection vulnerability in IntegrationTemplateProcessor.ReplaceTokens(), which substitutes user-controlled values into event-integration templates without JSON encoding. When an organization has configured an event integration whose template references a user-controlled token (such as #ActingUserName# or #UserName#, populated from a member's display name), an authenticated member can set their display name to JSON metacharacters and inject arbitra | [email protected] | 2.3 | 0.26% | 2026-06-25 | 2026-06-27 |
| CVE-2026-57521 | Bitwarden Server before 2026.5.0 contains a broken access control vulnerability that allows any authenticated user to access arbitrary organization billing data by supplying an arbitrary organizationId to the PreviewInvoiceController endpoints without membership or authorization checks. Attackers can exploit the missing ManageOrganizationBillingRequirement on the preview invoice endpoints to retrieve Stripe-computed tax totals, subscription status, and billing details derived from any target org | [email protected] | 5.3 | 0.20% | 2026-06-25 | 2026-06-27 |
| CVE-2026-57520 | Bitwarden Server before 2026.5.0 contains a privilege escalation vulnerability that allows authenticated Custom users with ManageUsers permission to remove Admin accounts from an organization by exploiting a missing role hierarchy check in the bulk user-remove endpoint. Attackers can supply Admin organization-user IDs in a bulk DELETE request to bypass the guard enforced on the single-user removal path, effectively removing one or more Admin accounts from an organization. | [email protected] | 7.1 | 0.35% | 2026-06-25 | 2026-06-30 |
| CVE-2026-43640 | Bitwarden Server prior to v2026.4.1 does not require master-password re-authentication when retrieving or rotating an organization's SCIM API key, allowing an authenticated user with SCIM management privileges to obtain the key using only a valid session. | [email protected] | 8.6 | 0.50% | 2026-05-11 | 2026-06-17 |
| CVE-2026-43639 | Bitwarden Server prior to v2026.4.0 contains a missing authorization vulnerability that allows a provider service user to add an arbitrary organization to their provider via `POST /providers/{providerId}/clients/existing`, resulting in takeover of the target organization; self-hosted installations are unaffected as this endpoint is restricted to Cloud via SelfHosted(NotSelfHostedOnly = true). | [email protected] | 8.9 | 0.60% | 2026-05-11 | 2026-06-17 |
| CVE-2026-43638 | Bitwarden Server prior to v2026.4.1 contains a missing authorization vulnerability that allows any authenticated user to write ciphers into an arbitrary organization via `POST /ciphers/import-organization` by submitting an empty `collections` array, which causes the server-side permission check to be skipped. | [email protected] | 5.3 | 0.19% | 2026-05-11 | 2026-06-17 |
| CVE-2026-42994 | Bitwarden CLI 2026.4.0 from 2026-04-22T21:57Z to 2026-04-22T23:30Z, when obtained from npm, had embedded malicious code. This is related to a Checkmarx supply chain incident. | [email protected] | 8.8 | 0.31% | 2026-05-01 | 2026-06-17 |
| CVE-2023-38840 | Bitwarden Desktop 2023.7.0 and below allows an attacker with local access to obtain sensitive information via the Bitwarden.exe process. | [email protected] | 5.5 | 0.56% | 2023-08-15 | 2026-06-17 |
| CVE-2023-27706 | Bitwarden Windows desktop application versions prior to v2023.4.0 store biometric keys in Windows Credential Manager, accessible to other local unprivileged processes. | [email protected] | 7.1 | 0.58% | 2023-06-09 | 2026-06-17 |
| CVE-2023-27974 | Bitwarden through 2023.2.1 offers password auto-fill when the second-level domain matches, e.g., a password stored for an example.com hosting provider when customer-website.example.com is visited. NOTE: the vendor's position is that "Auto-fill on page load" is not enabled by default. | [email protected] | 7.5 | 1.00% | 2023-03-08 | 2026-06-17 |
| CVE-2018-25081 | Bitwarden through 2023.2.1 offers password auto-fill within a cross-domain IFRAME element. NOTE: the vendor's position is that there have been important legitimate cross-domain configurations (e.g., an apple.com IFRAME element on the icloud.com website) and that "Auto-fill on page load" is not enabled by default. | [email protected] | 7.5 | 1.03% | 2023-03-08 | 2026-06-16 |
| CVE-2020-15879 | Bitwarden Server 1.35.1 allows SSRF because it does not consider certain IPv6 addresses (ones beginning with fc, fd, fe, or ff, and the :: address) and certain IPv4 addresses (0.0.0.0/8, 127.0.0.0/8, and 169.254.0.0/16). | [email protected] | 7.5 | 2.70% | 2020-07-21 | 2026-06-16 |
| CVE-2019-19766 | The Bitwarden server through 1.32.0 has a potentially unwanted KDF. | [email protected] | 7.5 | 1.35% | 2019-12-12 | 2026-06-16 |