vaultwarden vulnerabilities
CVEs whose affected-version data names the vaultwarden package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-116678Medium· 5.8Vaultwarden: Icon endpoint SSRF fix bypass via second-stage favicon IP literal URLs
Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to version 1.37.0, the Vaultwarden icon downloader validates the initial icon host and DNS results but passes favicon URLs parsed from attacker-controlled HTML to get_pa…
▾ Sunlitdani-garcia · vaultwardenvia CVEORG
CVE-2026-95814High· 8.1Vaultwarden through 1.37.3 omits organization membership status validation from three cipher access-restriction queries, allowing revoked and not-yet-confirmed members to retain read, write, delete, and attachment access to organization …
Vaultwarden through 1.37.3 omits organization membership status validation from three cipher access-restriction queries, allowing revoked and not-yet-confirmed members to retain read, write, delete, and attachment access to organization …
▾ Twilightdani-garcia · vaultwardenEPSS 0.43%via NVD