HIGHVulnerability
Verified
Global

NVD HIGH: CVE-2026-60104 — Bitwarden Server before 2026.6.0 does not verify that the email in a POST /auth-...

·Source: NIST NVD

Updated:

Executive Summary

Bitwarden Server before 2026.6.0 does not verify that the email in a POST /auth-requests/admin-request body belongs to the authenticated caller, allowing a low-privileged organization member to obtain another user's vault key and a victim-scoped access token by creating a Trusted Device Encryption authentication request, bound to an attacker-controlled public key, that is readable from an unauthen

Analysis

Bitwarden Server before 2026.6.0 does not verify that the email in a POST /auth-requests/admin-request body belongs to the authenticated caller, allowing a low-privileged organization member to obtain another user's vault key and a victim-scoped access token by creating a Trusted Device Encryption authentication request, bound to an attacker-controlled public key, that is readable from an unauthenticated endpoint once approved resulting in disclosure of the victim's vault key and account takeover. CVSS Score: 7.3. Published: 2026-07-08T20:17:00.413.

Indicators of Compromise (1)

CVE (1)
CVE-2026-60104
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Jul 8, 2026. Verified by: NIST.

Related Threats

LOWVulnerability

Lone Attacker Uses AI to Breach AWS Cloud Environment in 72 Hours

The attacker exploited AI workflows, chained cloud weaknesses, and stolen credentials to extort a large Amazon customer.

Dark Reading
MEDIUMVulnerability

Greek victims file lawsuit against Intellexa over Predator spyware

The use of the spyware came to light in 2022, with traces of Predator found on dozens of phones. The scandal led to the resignation of Greece’s intelligence service chief and the prime minister’s chief of staff.

The Record
HIGHVulnerability

NVD HIGH: CVE-2026-59806 — Gradio before 6.20.0 contains an open redirect and server-side request forgery v...

Gradio before 6.20.0 contains an open redirect and server-side request forgery vulnerability that allows attackers to redirect users to arbitrary URLs or perform client-side SSRF by supplying unvalidated HTTP/HTTPS URLs to the file_fetch() function in the /gradio_api/file= endpoint. Attackers can craft a malicious FileData response targeting internal endpoints such as cloud metadata services to re

CVE-2026-59806
NIST NVD