CVE-2026-57522
LowCVSS 3.5Exploitation Probability (EPSS)
Low risk12th percentile — higher than 12% of all known CVEs
Summary
A vulnerability in Bitwarden Server before version 2026.5.0 allows JSON injection via the IntegrationTemplateProcessor.ReplaceTokens() function, which substitutes user-controlled values into event integration templates without JSON encoding. An authenticated organization member can set their display name to JSON metacharacters and inject arbitrary key-value pairs into rendered payloads delivered to webhook, SIEM, Slack, Teams, or Datadog endpoints.
Risk Assessment
An attacker can forge data in event integrations, potentially leading to manipulation of logs, alerts, or automations in the organization's monitoring and communication systems.
Recommendation
Immediately update Bitwarden Server to version 2026.5.0 or later, which includes a fix for the JSON injection vulnerability.
Original NVD description (English source)
Bitwarden Server before 2026.5.0 contains a JSON injection vulnerability in IntegrationTemplateProcessor.ReplaceTokens(), which substitutes user-controlled values into event-integration templates without JSON encoding. When an organization has configured an event integration whose template references a user-controlled token (such as #ActingUserName# or #UserName#, populated from a member's display name), an authenticated member can set their display name to JSON metacharacters and inject arbitrary key-value pairs into the rendered payloads delivered to webhook, SIEM, Slack, Teams, or Datadog endpoints, making injected fields indistinguishable from legitimate template output.