Description
Bitwarden Server prior to v2026.4.1 does not require master-password re-authentication when retrieving or rotating an organization-s SCIM API key, allowing an authenticated user with SCIM management privileges to obtain the key using only a valid session.
CVSS 8.1EPSS 0.504%Risque 0.85
Voir la source- Publication
- 2026-05-11 18:16:37
- Versions concernées
- <v2026.4.1
- Type
- Core software
- Vecteur
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N