CVE-2026-43640

HighCVSS 8.1/10Last modified Oct 26, 2026

Description

Bitwarden Server prior to v2026.4.1 does not require master-password re-authentication when retrieving or rotating an organization's SCIM API key, allowing an authenticated user with SCIM management privileges to obtain the key using only a valid session.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-303

Affected software

Vendor	Product	Versions
bitwarden	server	< 2026.4.1

References

https://github.com/bitwarden/server/commit/eb251d9bf80724c87b187661783b9354d1784083Patch
https://github.com/bitwarden/server/pull/7403Issue Tracking, Patch
https://github.com/bitwarden/server/releases/tag/v2026.4.1Release Notes
https://sanjokkarki.com.np/blog/bitwarden-scim-key-bypassExploit, Third Party Advisory
https://www.vulncheck.com/advisories/bitwarden-server-authentication-bypass-via-scim-api-keyThird Party Advisory

Timeline

Published: May 11, 2026
Last modified: Oct 26, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-436419.8Softaculous Virtualizor before 3.2.9 (Patch 9) and 3.0.0 contains an OS command injection vulnerability in the billing module handler that a CVE-2026-436428.1Softaculous Virtualizor before 3.2.9 (Patch 9) and 3.0.0 contains a PHP object injection vulnerability in the billing module handler that al CVE-2026-436437.5Softaculous Virtualizor before 3.2.9 (Patch 9) and 3.0.0 contains an authorization bypass vulnerability in the billing module handler that a CVE-2026-436446.1podinfo through 6.11.2 contains a reflected cross-site scripting vulnerability in the /echo and /api/echo endpoints where the echoHandler wr CVE-2026-436467.5Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Wicket. This issue affects Apache Wicket: from 8.0.0 thr CVE-2026-43659.1The LearnPress plugin for WordPress is vulnerable to unauthorized data deletion due to a missing capability check on the `delete_question_an CVE-2026-436527.5A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26.5. An app may be able to access protec CVE-2026-436536.2The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS CVE-2026-436547.5The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS CVE-2026-436557.3An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 2 CVE-2026-436567.3An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and CVE-2026-436573.3A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.5 and iPadOS 26.5. A malicious app may be able