Vaultwarden vulnerabilities

In Vaultwarden, prior to version 1.35.4, there is a vulnerability that allows bypassing brute-force login protection if email 2fa is enabled. The 2fa function send_email_login acts as an oracle, enabling attackers to test username-password combinations without rate limiting.

Vaultwarden, a Bitwarden-compatible server, prior to version 1.35.5 allowed an unconfirmed organization owner to purge the entire organization vault. The organization invite flow did not verify confirmation status, enabling a user invited as an owner to delete data.

Vaultwarden prior to version 1.35.5 does not verify that user and group entries belong to the same organization, allowing unauthorized access to vault data of another organization.

Vaultwarden through 1.37.3 omits organization membership status validation from three cipher access-restriction queries, allowing revoked and not-yet-confirmed members to retain read, write, delete, and attachment access to organization ciphers.

A vulnerability in Vaultwarden prior to 1.36.0 allows an attacker to hijack a victim's account via SSO. The issue is due to missing verification of the IdP email_verified claim when linking an identity to an existing local account.

An SSRF vulnerability in Vaultwarden before version 1.36.0 allowed bypassing IP address validation in decimal, hexadecimal, and octal formats during icon fetching, enabling internal network and port scanning.

A vulnerability in Vaultwarden prior to version 1.36.0 allowed SSO discovery and pre-validation flow to leak organization-related SSO metadata, including organizationIdentifier values, for arbitrary email addresses. This enabled obtaining a valid pre-validation JWT with only the discovered identifier, facilitating SSO-enabled organization enumeration and authentication workflow abuse.

A vulnerability in Vaultwarden prior to version 1.36.0 allows an unauthenticated attacker to hijack a user session by manipulating the SSO authorization flow. The lack of binding the OAuth state parameter to the browser session and acceptance of attacker-controlled PKCE parameters enable triggering authentication at the identity provider and redeeming tokens.

Vaultwarden version 1.35.4 and earlier is missing the has_full_access() authorization check on the get_org_collections_details endpoint (GET /api/organizations/{org_id}/collections/details), which exists on the sibling get_org_collections endpoint. This allows any Manager-role user with accessAll=False and no collection assignments to retrieve names, UUIDs, user-to-collection mappings, and group-to-collection mappings for all collections in the organization. The issue has been fixed in version 1.35.5.

Vaultwarden versions 1.35.4 and earlier have a vulnerability in the WebAuthn authentication flow. The validate_webauthn_login() function updates persistent credential metadata (backup_eligible and backup_state flags) based on unverified authenticatorData before signature validation. An attacker who knows the user's password but cannot produce a valid WebAuthn signature can permanently modify the backup flags for that credential. If signature verification fails, the database update is not rolled back. This can lead to persistent denial of service of WebAuthn two-factor authentication. Fixed in version 1.35.5.