Bitwarden Server 2025.6.0 before 2026.5.0 declares the @ExternalId parameter of the User_ReadBySsoUserOrganizationIdExternalId stored procedure as NVARCHAR(50) while the column it queries stores NVARCHAR(300), silently truncating the SSO login identifier on SQL Server deployments and allowing a user whose identity-provider identifier begins with another organization member's full 50-character identifier to authenticate as that member and obtain a victim-scoped access token.

Attack Vector Network

Attack Complexity High

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
bitwarden bitwarden server unaffected
Version Status Constraints
2025.6.0 affected < 2026.5.0

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

No data.

Project Subscriptions

No data.

Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://github.com/bitwarden/server/commit/27ae3d5455f723975fac03819eaeba8710666bc4 cve-icon cve-icon
https://github.com/bitwarden/server/pull/7501 cve-icon cve-icon
https://github.com/bitwarden/server/releases/tag/v2026.5.0 cve-icon cve-icon
https://sanjokkarki.com.np/blog/bitwarden-sso-externalid-truncation cve-icon cve-icon
https://www.vulncheck.com/advisories/bitwarden-server-authentication-bypass-via-sso-identifier-truncation cve-icon cve-icon
History

Tue, 29 Sep 2026 02:15:00 +0000

Type Values Removed Values Added
Description Bitwarden Server 2025.6.0 before 2026.5.0 declares the @ExternalId parameter of the User_ReadBySsoUserOrganizationIdExternalId stored procedure as NVARCHAR(50) while the column it queries stores NVARCHAR(300), silently truncating the SSO login identifier on SQL Server deployments and allowing a user whose identity-provider identifier begins with another organization member's full 50-character identifier to authenticate as that member and obtain a victim-scoped access token.
Title Bitwarden Server 2025.6.0 < 2025.6.0 Authentication Bypass via SSO Identifier Truncation
Weaknesses CWE-303
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 7.7, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-09-29T01:58:32.484Z

Reserved: 2026-09-28T15:44:45.389Z

Link: CVE-2026-101878

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-29T02:16:54.990

Modified: 2026-09-29T02:16:54.990

Link: CVE-2026-101878

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-29T04:00:08Z

Weaknesses