CVE-2026-47159: Vaultwarden Auth Bypass Vulnerability

CVE-2026-47159 Overview

CVE-2026-47159 is an authentication weakness in Vaultwarden, a Bitwarden-compatible server written in Rust. Versions prior to 1.36.0 expose organization-related Single Sign-On (SSO) metadata through the SSO discovery and pre-validation flow. The server returns organizationIdentifier values for arbitrary email addresses submitted to the discovery endpoint. A valid pre-validation JSON Web Token (JWT) can then be obtained using only the disclosed identifier. This behavior enables enumeration of SSO-enabled organizations and abuse of the authentication workflow. The issue is fixed in Vaultwarden 1.36.0 and is tracked as [CWE-287: Improper Authentication].

Critical Impact
Unauthenticated network attackers can enumerate SSO-enabled organizations and obtain valid pre-validation JWTs, exposing tenant metadata and enabling downstream authentication workflow abuse.

Affected Products

Vaultwarden versions prior to 1.36.0
Vaultwarden deployments with SSO discovery and pre-validation enabled
Bitwarden-compatible clients relying on Vaultwarden SSO metadata endpoints

Discovery Timeline

2026-07-15 - CVE-2026-47159 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-47159

Vulnerability Analysis

The vulnerability resides in Vaultwarden's SSO discovery and pre-validation flow. When a client submits an email address to the discovery endpoint, the server returns organization-related SSO metadata, including the organizationIdentifier associated with that address. The response does not distinguish between valid and non-existent addresses in a way that prevents disclosure. Once an attacker holds a discovered organizationIdentifier, the pre-validation endpoint issues a valid JWT without additional proof of association with the organization. This weakens the authentication boundary the SSO flow is intended to enforce.

Root Cause

The root cause is improper authentication and information exposure in the SSO metadata endpoints ([CWE-287]). The discovery endpoint treats organization identifier lookup as a public operation, and pre-validation trusts the presence of a valid identifier as sufficient input. There is no rate limiting, tenant binding, or authenticated context validation between the two steps. This design allows the two endpoints to be chained by an unauthenticated caller.

Attack Vector

An unauthenticated attacker with network access to the Vaultwarden instance issues repeated discovery requests with target email addresses. The server returns SSO metadata that reveals which addresses belong to SSO-enabled organizations and exposes the organizationIdentifier. The attacker then requests a pre-validation JWT using the identifier alone. The resulting token can be used to probe or interact with SSO authentication flows downstream. Refer to the GitHub Security Advisory GHSA-hxqh-ff5p-wfr3 for the maintainer's technical description.

Detection Methods for CVE-2026-47159

Indicators of Compromise

High-volume requests to the Vaultwarden SSO discovery endpoint from a single source IP or user agent.
Sequential discovery calls followed by pre-validation JWT requests for the same organizationIdentifier.
Discovery requests containing enumerated or dictionary-based email address patterns.

Detection Strategies

Inspect web server and reverse proxy logs for anomalous request rates against Vaultwarden SSO discovery and pre-validation URLs.
Correlate discovery responses that return non-empty organizationIdentifier values with subsequent pre-validation JWT issuance from the same client.
Alert on unauthenticated clients that iterate through many distinct email addresses within a short time window.

Monitoring Recommendations

Forward Vaultwarden application and proxy logs to a centralized log platform for retention and correlation.
Track baseline request volumes to /identity and SSO-related endpoints, and alert on statistical deviations.
Monitor JWT issuance events for pre-validation tokens tied to identifiers not associated with the requesting client session.

How to Mitigate CVE-2026-47159

Immediate Actions Required

Upgrade Vaultwarden to version 1.36.0 or later, which contains the fix.
Review access logs for enumeration activity against SSO discovery endpoints prior to the upgrade.
Restrict network exposure of the Vaultwarden instance to trusted networks where feasible.

Patch Information

The fix is available in Vaultwarden release 1.36.0. The change was introduced in pull request #7163 and applied in commit d297e274. Administrators should update container images, binaries, and any downstream deployment manifests to reference the patched version.

Workarounds

Place Vaultwarden behind a reverse proxy that enforces rate limiting on SSO discovery and pre-validation endpoints.
Restrict access to SSO endpoints using IP allowlists or Web Application Firewall (WAF) rules until the upgrade is completed.
Disable SSO features on the Vaultwarden instance if they are not required by the deployment.

bash

# Example: pull and deploy the patched Vaultwarden image
docker pull vaultwarden/server:1.36.0
docker stop vaultwarden && docker rm vaultwarden
docker run -d --name vaultwarden \
  -v /vw-data/:/data/ \
  -p 8080:80 \
  vaultwarden/server:1.36.0