CVE-2026-60104

HIGH

Bitwarden Server before 2026.6.0 does not verify that the email in a POST /auth-requests/admin-request body belongs to the authenticated caller, allowing a low-privileged organization member to obtain another user's vault key and a victim-scoped access token by creating a Trusted Device Encryption authentication request, bound to an attacker-controlled public key, that is readable from an unauthenticated endpoint once approved resulting in disclosure of the victim's vault key and account takeover.

CVSS v3.1 Score

8.7
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Attack Vector
NETWORK
Complexity
LOW
Privileges
LOW
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
NONE
Published: 7/8/2026Modified: 7/9/2026

Related Intelligence (1)

HIGHVulnerability

NVD HIGH: CVE-2026-60104 — Bitwarden Server before 2026.6.0 does not verify that the email in a POST /auth-...

Bitwarden Server before 2026.6.0 does not verify that the email in a POST /auth-requests/admin-request body belongs to the authenticated caller, allowing a low-privileged organization member to obtain another user's vault key and a victim-scoped access token by creating a Trusted Device Encryption authentication request, bound to an attacker-controlled public key, that is readable from an unauthen

CVE-2026-60104
NIST NVD

References (5)

https://github.com/bitwarden/server/commit/dcf4c486b2b5bedecc03a48b427243328cc74a9ahttps://github.com/bitwarden/server/pull/7615https://github.com/bitwarden/server/releases#release-v2026.6.0https://sanjokkarki.com.np/blog/bitwarden-vault-key-heisthttps://www.vulncheck.com/advisories/bitwarden-server-authorization-bypass-via-admin-auth-request