CVE-2026-57522

MediumCVSS 5.0/10Last modified Oct 25, 2026

Description

Bitwarden Server before 2026.5.0 contains a JSON injection vulnerability in IntegrationTemplateProcessor.ReplaceTokens(), which substitutes user-controlled values into event-integration templates without JSON encoding. When an organization has configured an event integration whose template references a user-controlled token (such as #ActingUserName# or #UserName#, populated from a member's display name), an authenticated member can set their display name to JSON metacharacters and inject arbitrary key-value pairs into the rendered payloads delivered to webhook, SIEM, Slack, Teams, or Datadog endpoints, making injected fields indistinguishable from legitimate template output.

Metrics

CVSS 3.1 5.0/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N

Weakness enumeration

CWE-74

Affected software

Vendor	Product	Versions
bitwarden	server	< 2026.5.0

References

https://github.com/bitwarden/server/commit/a26afd18130ef985ede5c97d277820d045185a28Patch
https://github.com/bitwarden/server/pull/7593Issue Tracking
https://github.com/bitwarden/server/releases/tag/v2026.5.0Release Notes
https://sanjokkarki.com.np/blog/bitwarden-webhook-json-injectionExploit, Patch, Third Party Advisory
https://www.vulncheck.com/advisories/bitwarden-server-json-injection-via-webhook-templatesThird Party Advisory

Timeline

Published: Jun 25, 2026
Last modified: Oct 25, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-575278.8Zed Attack Proxy (ZAP) ViewState add-on before version 4 contains an insecure deserialization vulnerability that allows attackers who contro CVE-2026-57536.5The All-in-One WP Migration Unlimited Extension plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including CVE-2026-575305.4Milkdown before 7.21.3 contains a stored cross-site scripting vulnerability in the @milkdown/preset-commonmark and @milkdown/components pack CVE-2026-575315.4Milkdown before 7.21.3 contains a DOM cross-site scripting vulnerability in the @milkdown/plugin-emoji package that allows unauthenticated a CVE-2026-575328.8Malicious HTML content contained in the layout specification of a PDF ticket or badge layout was executed when the PDF editor is opened in CVE-2026-575332.1Malicious HTML content could be injected into the page pretix shows when redirection to an untrusted page occurs. Since this page has a Co CVE-2026-575342.1Malicious HTML content could be injected into the content of a page in the pretix-pages plugin.CVE-2026-575352.1Content injected to PDF rendering contexts could, in many places, include HTML content including <img> tags. If the src attribute of these CVE-2026-575366.3Our payment integration with Mollie did not properly validate payment status responses. An attacker could use a successful payment status CVE-2026-575377.8Memory Corruption when accessing and modifying geographic mapping data concurrently without proper synchronization.CVE-2026-57546.1Reflected Cross-Site Scripting (XSS) Vulnerability in Radware Alteon 34.5.4.0 vADC load-balancer allows an attacker to inject malicious scri CVE-2026-575457.8Memory corruption when processing draw objects of incorrect type during graphics command list execution.