Vaultwarden: Brute-force protection bypass vulnerability

An issue in the component src/api/identity.rs of Vaultwarden prior to v1.32.5 allows attackers to impersonate users, including Administrators, via a crafted authorization request

An HTML injection vulnerability in Vaultwarden prior to v1.32.5 allows attackers to execute arbitrary code via injecting a crafted payload into the username field of an e-mail…

An issue was discovered in Vaultwarden (formerly Bitwarden_RS) 1.30.3

Vaultwarden: Cross-Org Group Binding Enables Unauthorized Read And Write Access Into Another Organization

Vaultwarden: CSRF in SSO Authorization Flow

Vaultwarden: Collection Management Operations Allowed Without `manage` Verification for Manager Role

Vaultwarden: Privilege Escalation via Bulk Permission Update to Unauthorized Collections by Manager

Vaultwarden through 1.37.3 Authorization Bypass via Missing Status Check

Vaultwarden: Unconfirmed Owner Can Purge Entire Organization Vault

Vaultwarden: Refresh tokens not invalidated on security stamp rotation

Vaultwarden: SSO Email Auto-Link Can Bind an Existing Local Account to an Attacker-Controlled IdP Identity

vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs

Privilege escalation allows organization groups to be updated/deleted if their UUID is known in vaultwarden

vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs

Vaultwarden: Authentication Flow Information Disclosure in SSO Discovery Allows Organization Enumeration and Pre-Validation Token Exposure

vaultwarden has Full Cipher Enumeration Ignoring Organization Collection Permissions

An issue was discovered in Vaultwarden (formerly Bitwarden_RS) 1.30.3

Vaultwarden: 2FA Bypass on Protected Actions due to Faulty Rate Limit Enforcement

Vaultwarden: Icon endpoint SSRF fix bypass via second-stage favicon IP literal URLs

Vaultwarden: Server-side request forgery (SSRF) via Icon Endpoint Decimal/Hex/Octal IP Bypass

Vaultwarden WebAuthn credential metadata tampered before signature verification

Vaultwarden: Unauthorized Access via Partial Update API on Another User’s Cipher

Vaultwarden v1.32.5 was discovered to contain an authenticated reflected cross-site scripting (XSS) vulnerability via the component /api/core/mod.rs

An issue was discovered in Vaultwarden (formerly Bitwarden_RS) 1.30.3

Vaultwarden missing authorization check allows Manager-role users to enumerate all collections