Description
Bitwarden Server prior to v2026.4.1 does not require master-password re-authentication when retrieving or rotating an organization-s SCIM API key, allowing an authenticated user with SCIM management privileges to obtain the key using only a valid session.
CVSS 8.1EPSS 0.504%Risk 0.85
View source- Published
- 2026-05-11 18:16:37
- Affected versions
- <v2026.4.1
- Type
- Core software
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N