CVE-2026-101878: Bitwarden Server Auth Bypass Vulnerability

CVE-2026-101878 Overview

Bitwarden Server versions 2025.6.0 through 2026.4.x contain an authentication bypass caused by a numeric truncation error in a SQL Server stored procedure. The User_ReadBySsoUserOrganizationIdExternalId procedure declares the @ExternalId parameter as NVARCHAR(50), while the underlying SsoUser.ExternalId column stores values up to NVARCHAR(300). SQL Server silently truncates the incoming identifier to 50 characters before comparison. An attacker whose identity provider (IdP) identifier begins with another organization member's full 50-character identifier can authenticate as that victim and receive a victim-scoped access token, exposing stored vault material to unauthorized access.

Critical Impact

A low-privileged organization member can impersonate another SSO-authenticated user in the same Bitwarden organization and obtain their access token.

Affected Products

• Bitwarden Server 2025.6.0 and later, prior to 2026.5.0
• Self-hosted Bitwarden deployments using SQL Server as the backing database
• Bitwarden organizations with Single Sign-On (SSO) enabled

Discovery Timeline

• 2026-09-29 - CVE-2026-101878 published to NVD
• 2026-09-30 - Last updated in NVD database
• v2026.5.0 - Bitwarden releases patched server version

Technical Details for CVE-2026-101878

Vulnerability Analysis

The flaw resides in the T-SQL stored procedure [dbo].[User_ReadBySsoUserOrganizationIdExternalId], which resolves an SSO login to a Bitwarden user record. The procedure accepts an @ExternalId parameter typed as NVARCHAR(50). When the identity provider issues an identifier longer than 50 characters, SQL Server truncates the value at the parameter boundary before the WHERE SU.[ExternalId] = @ExternalId predicate executes.

Because the stored ExternalId column supports up to 300 characters, two distinct IdP subject identifiers can collide after truncation. An attacker who can register or provision an IdP identity whose first 50 characters match a target user's full 50-character identifier will resolve to the victim's row. Bitwarden then issues a session and access token bound to the victim account, defeating the intended trust relationship with the identity provider [CWE-303].

Root Cause

The root cause is an incorrect parameter width in the stored procedure signature: @ExternalId NVARCHAR(50) instead of NVARCHAR(300). This is a boundary condition and numeric truncation error at the database layer, not in application code, so upstream input validation in the .NET service does not prevent the mismatch.

Attack Vector

Exploitation requires the attacker to control an IdP identity within an organization that federates to a vulnerable Bitwarden server. The attacker manipulates the SSO ExternalId value returned by the identity provider so that its first 50 characters equal the victim's identifier of exactly that length. Upon SSO login, Bitwarden matches the truncated identifier to the victim and completes authentication as that user.

// Patch: src/Sql/dbo/Stored Procedures/User_ReadBySsoUserOrganizationIdExternalId.sql
CREATE PROCEDURE [dbo].[User_ReadBySsoUserOrganizationIdExternalId]
    @OrganizationId UNIQUEIDENTIFIER,
-    @ExternalId NVARCHAR(50)
+    @ExternalId NVARCHAR(300)
AS
BEGIN
    SET NOCOUNT ON

Source: GitHub Commit 27ae3d5

Detection Methods for CVE-2026-101878

Indicators of Compromise

• SSO authentication events where the IdP sub or ExternalId claim exceeds 50 characters and shares a 50-character prefix with another user's identifier in the same organization.
• Successful Bitwarden logins for a user whose IdP session was not initiated from an expected device, geolocation, or client fingerprint.
• Vault item access, export, or organization membership changes performed shortly after an anomalous SSO login.

Detection Strategies

• Query the SsoUser table for OrganizationId groupings where multiple rows share the same first 50 characters of ExternalId; any collision on a vulnerable server indicates exploitation potential.
• Correlate Bitwarden application logs with IdP logs (Okta, Entra ID, Ping, etc.) to identify SSO assertions whose subject identifier does not match the Bitwarden user historically bound to that account.
• Alert on SSO logins immediately followed by access token issuance for accounts that normally authenticate via a different flow.

Monitoring Recommendations

• Enable and centralize Bitwarden server audit logs and forward IdP sign-in logs to a SIEM for cross-source correlation.
• Monitor administrative actions (organization role changes, collection permission edits, vault exports) executed within minutes of SSO authentication.
• Track database-level errors or warnings from SQL Server related to string truncation on the User_ReadBySsoUserOrganizationIdExternalId procedure.

How to Mitigate CVE-2026-101878

Immediate Actions Required

• Upgrade all self-hosted Bitwarden Server deployments to v2026.5.0 or later.
• Audit the SsoUser table for ExternalId values that share a 50-character prefix within the same organization and revoke active sessions for affected accounts.
• Rotate access tokens and force re-authentication for organization members after patching.

Patch Information

Bitwarden fixed the issue in Bitwarden Release v2026.5.0 via GitHub Pull Request #7501. The migration script 2026-04-23_00_UpdateReadBySsoUserOrganizationIdExternalI.sql replaces the stored procedure definition, widening @ExternalId from NVARCHAR(50) to NVARCHAR(300) so the parameter matches the storage column. Additional analysis is available in the VulnCheck Advisory and the Sanjok Karki technical write-up.

Workarounds

• If patching is delayed, manually apply the updated stored procedure definition to the SQL Server database to widen the @ExternalId parameter to NVARCHAR(300).
• Temporarily restrict SSO provisioning so that all ExternalId values are constrained to 50 characters or fewer, eliminating the truncation collision surface.
• Disable SSO login flows for high-value organizations until the server is upgraded, requiring master-password authentication instead.

# Apply the fixed stored procedure directly on SQL Server
sqlcmd -S <sql-host> -d vault -i \
  util/Migrator/DbScripts/2026-04-23_00_UpdateReadBySsoUserOrganizationIdExternalI.sql

# Verify the parameter width post-migration
sqlcmd -S <sql-host> -d vault -Q \
  "SELECT name, max_length FROM sys.parameters \
   WHERE object_id = OBJECT_ID('dbo.User_ReadBySsoUserOrganizationIdExternalId');"