CVE-2026-47158: Vaultwarden SSO Auth Bypass Vulnerability

CVE-2026-47158 Overview

CVE-2026-47158 is a high-severity authentication flaw in Vaultwarden, a Bitwarden-compatible server written in Rust. Versions prior to 1.36.0 fail to bind the OAuth state parameter accepted by /connect/authorize to the initiating browser session. The Single Sign-On (SSO) flow also accepts attacker-controlled Proof Key for Code Exchange (PKCE) parameters and leaves SsoAuth records intact after failed token exchanges. An unauthenticated attacker can induce Identity Provider (IdP) authentication and redeem tokens to hijack a fully authenticated session. The issue is fixed in version 1.36.0 and is classified as Cross-Site Request Forgery [CWE-352].

Critical Impact
An unauthenticated remote attacker can hijack a victim's SSO authentication flow to obtain a fully authenticated session in the victim's Vaultwarden vault.

Affected Products

Vaultwarden versions prior to 1.36.0
Deployments using the SSO authorization flow via /connect/authorize
Instances integrated with external OAuth 2.0 / OpenID Connect IdPs

Discovery Timeline

2026-07-15 - CVE CVE-2026-47158 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-47158

Vulnerability Analysis

The vulnerability resides in Vaultwarden's SSO authorization handler at /connect/authorize. The OAuth 2.0 state parameter is intended to bind an authorization response to the browser session that initiated it. In vulnerable versions, Vaultwarden does not enforce this binding, so any browser presenting a valid state value can complete the flow.

Compounding this weakness, the server accepts PKCE parameters supplied by the client without ensuring they originate from the legitimate initiator. An attacker can precompute a code_verifier and matching code_challenge, then substitute those values into a victim-facing authorization URL. When failed token exchange attempts occur, stale SsoAuth records persist in the database rather than being invalidated, expanding the exploitation window.

The combined result is a session-fixation style attack layered on top of an OAuth CSRF vector, culminating in full authentication takeover.

Root Cause

The root cause is missing anti-CSRF binding between the OAuth state value and the initiator's browser session [CWE-352]. Neither cookie-bound state nor server-side session mapping is validated. The lack of server-generated PKCE parameters and the absence of cleanup for failed SsoAuth records amplify the flaw.

Attack Vector

Exploitation requires user interaction — the victim must follow an attacker-supplied link or visit a page that triggers the crafted authorization request. The attacker constructs an OAuth request using their own PKCE code_verifier, induces the victim to authenticate at the IdP, and then redeems the resulting authorization code using the pre-known verifier. Because state binding is absent, the redeemed session is issued to the attacker rather than the victim, granting access to the victim's vault. No prior credentials are needed on the target Vaultwarden instance.

See the GitHub Security Advisory GHSA-pfp2-jhgq-6hg5 and the GitHub Pull Request Discussion for full technical details.

Detection Methods for CVE-2026-47158

Indicators of Compromise

Unexpected successful SSO logins for user accounts that did not initiate an authentication attempt.
Multiple /connect/authorize requests originating from different IP addresses or User-Agents for the same state value.
Residual SsoAuth records in the Vaultwarden database that outlive normal authorization windows.
Token exchange requests where the source IP differs from the IP that initiated the authorization request.

Detection Strategies

Correlate the initiating IP and User-Agent of /connect/authorize requests with the IP and User-Agent redeeming the authorization code at the token endpoint.
Alert on SsoAuth records that persist beyond the expected authorization lifetime or that are reused across sessions.
Monitor IdP logs for authentication events that immediately precede logins from geographically inconsistent client IPs.

Monitoring Recommendations

Enable verbose logging on the Vaultwarden SSO endpoints and forward events to a centralized log store for retention.
Track anomalous ratios of failed-to-successful token exchanges per user account.
Review IdP audit trails weekly for authentication requests that were not user-initiated.

How to Mitigate CVE-2026-47158

Immediate Actions Required

Upgrade Vaultwarden to version 1.36.0 or later, which fixes the state binding, PKCE handling, and stale SsoAuth record issues.
Rotate SSO client secrets and invalidate all active sessions after upgrading to prevent replay of pre-existing tokens.
Audit recent SSO login events and force password/vault re-verification for any user whose session cannot be attributed to a legitimate initiator.

Patch Information

The fix is delivered in Vaultwarden 1.36.0. Review the GitHub Release Version 1.36.0 notes and the corresponding GitHub Commit Details for implementation specifics. The patch enforces server-side generation and validation of both state and PKCE parameters and invalidates SsoAuth records upon failed token exchange.

Workarounds

Temporarily disable SSO authentication and require users to log in with local credentials until the upgrade is applied.
Restrict access to the Vaultwarden /connect/authorize endpoint to trusted networks via a reverse proxy or Web Application Firewall (WAF) rule.
Shorten the lifetime of SsoAuth records at the database layer to minimize the exploitation window if immediate patching is not possible.

bash

# Configuration example: pin Vaultwarden to the patched version
docker pull vaultwarden/server:1.36.0
docker stop vaultwarden && docker rm vaultwarden
docker run -d --name vaultwarden \
  -e SSO_ENABLED=false \
  -v /vw-data/:/data/ \
  -p 8080:80 \
  vaultwarden/server:1.36.0