CVE-2026-43640CWE-303

Bitwarden Server < 2026.4.1 Authentication Bypass via SCIM API Key

High · published May 11, 2026

CVSS v4.0
8.6
EPSS
1%
Percentile
52.9
In the wild
Unconfirmed
What it is

Bitwarden Server prior to v2026.4.1 does not require master-password re-authentication when retrieving or rotating an organization's SCIM API key, allowing an authenticated user with SCIM management privileges to obtain the key using only a valid session.

The record
Technical detail
CVSS v4.0
8.6 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00707 · 52.9th percentile
Weakness
CWE-303 · Incorrect Implementation of Authentication Algorithm
Published
2026-05-11T17:14Z
EPSS history
Timeline
  • 11 MAY 17:14Z
    Bitwarden Server < 2026.4.1 Authentication Bypass via SCIM API Key
    cvelistv5