CVE-2026-43911CWE-613

Vaultwarden: Refresh tokens not invalidated on security stamp rotation

Medium · published May 11, 2026

CVSS v3.1
6.8
EPSS
0%
Percentile
22.4
In the wild
Unconfirmed
What it is

Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.35.5, refresh tokens are not invalidated when the user's security_stamp is rotated by some security-sensitive operations (password change, KDF change, key rotation, email change, org admin password reset, emergency access takeover). This allows an attacker holding a previously obtained refresh token to maintain session access even after the user has taken action to secure their account. This vulnerability is fixed in 1.35.5.

The record
Technical detail
CVSS v3.1
6.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00308 · 22.4th percentile
Weakness
CWE-613 · Insufficient Session Expiration
Published
2026-05-11T21:54Z
EPSS history
Timeline
  • 11 MAY 21:54Z
    Vaultwarden: Refresh tokens not invalidated on security stamp rotation
    cvelistv5