CVE-2026-47164: Vaultwarden SSO Auth Bypass Vulnerability

CVE-2026-47164 Overview

CVE-2026-47164 is an access control vulnerability [CWE-284] in Vaultwarden, a Bitwarden-compatible password server written in Rust. The flaw exists in the Single Sign-On (SSO) login flow of versions prior to 1.36.0. When SSO_SIGNUPS_MATCH_EMAIL=true is configured, Vaultwarden failed to validate the Identity Provider (IdP) email_verified claim during account linking. An attacker controlling an IdP identity can assert a victim's email address and bind to that existing local account. The issue was resolved in Vaultwarden version 1.36.0.

Critical Impact
An attacker-controlled IdP identity asserting a victim email address can authenticate as that victim account, compromising stored password vault data.

Affected Products

Vaultwarden versions prior to 1.36.0
Deployments with SSO_SIGNUPS_MATCH_EMAIL=true enabled
Vaultwarden instances integrated with external IdPs for SSO

Discovery Timeline

2026-07-15 - CVE-2026-47164 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-47164

Vulnerability Analysis

The vulnerability resides in Vaultwarden's SSO authentication flow. Vaultwarden supports linking IdP identities to existing local accounts through the SSO_SIGNUPS_MATCH_EMAIL configuration option. When enabled, this feature matches an incoming SSO assertion to a local account based on the email address returned by the IdP.

The email_verified claim from the IdP was validated only during new-user creation. During the account-linking path, this claim was ignored. An attacker who controls an IdP tenant can register or configure an identity that asserts an arbitrary email address without proving ownership. Vaultwarden then binds the attacker's IdP identity to the matching local account and issues an authenticated session.

This is a broken access control weakness [CWE-284] rooted in inconsistent enforcement of identity assurance between two authentication code paths.

Root Cause

The root cause is the missing email_verified check in the SSO account-linking branch. The linking logic trusted the raw email value returned by the IdP without confirming the IdP had verified the user's control over that mailbox. Any IdP that permits unverified email claims — including attacker-operated IdPs federated into a multi-tenant provider — could be used to forge the assertion.

Attack Vector

Exploitation requires network access to the Vaultwarden SSO endpoint and the ability to control or configure an IdP identity that Vaultwarden trusts. The attacker sets the email attribute of a controlled identity to the victim's registered Vaultwarden email. The attacker initiates the SSO login flow, Vaultwarden matches the asserted email to the victim's local account, and issues a valid session. The attacker gains authenticated access to the victim's password vault without knowledge of the victim's master password or credentials.

The vulnerability manifests in the SSO login handler. See the GitHub Security Advisory GHSA-6x5c-84vm-5j56 and the remediation commit for the code-level fix.

Detection Methods for CVE-2026-47164

Indicators of Compromise

SSO authentication events where an IdP identity is linked to a pre-existing local account without a prior successful password login by that account.
Multiple distinct IdP sub (subject) identifiers observed authenticating as the same local Vaultwarden user over a short interval.
Vault access from unusual geographic locations or IP addresses immediately following an SSO linking event.
IdP audit logs showing accounts with unverified email addresses matching known Vaultwarden user emails.

Detection Strategies

Correlate Vaultwarden authentication logs with IdP logs to identify SSO account bindings where the source IdP did not assert email_verified=true.
Query for Vaultwarden accounts that transitioned from password-based to SSO authentication without an administrator-approved linking workflow.
Alert on any first-time IdP subject identifier binding to a Vaultwarden account that already contains stored vault items.

Monitoring Recommendations

Enable and centralize Vaultwarden application logs alongside IdP sign-in logs for cross-source correlation.
Monitor password vault access patterns for anomalies following SSO configuration changes or version rollbacks.
Track use of the SSO_SIGNUPS_MATCH_EMAIL configuration flag across all Vaultwarden deployments in the environment.

How to Mitigate CVE-2026-47164

Immediate Actions Required

Upgrade all Vaultwarden instances to version 1.36.0 or later immediately.
Audit existing SSO account bindings created while running vulnerable versions and revoke any that cannot be verified as legitimate.
Force password rotation for all stored vault items on accounts that used SSO linking with SSO_SIGNUPS_MATCH_EMAIL=true.
Review IdP configurations to ensure only IdPs that enforce email verification are federated with Vaultwarden.

Patch Information

The vulnerability is fixed in Vaultwarden version 1.36.0. The remediation, delivered via pull request #7163, adds the email_verified claim check to the SSO account-linking code path so that unverified IdP email assertions can no longer bind to existing local accounts.

Workarounds

Disable the SSO_SIGNUPS_MATCH_EMAIL option until the upgrade to 1.36.0 is completed.
Restrict SSO federation to IdPs that mandate email verification and reject identities with email_verified=false.
Require administrator approval for any SSO identity linking to pre-existing local accounts.

bash

# Configuration example - disable email-based SSO account linking
# In Vaultwarden environment configuration (.env or docker-compose)
SSO_SIGNUPS_MATCH_EMAIL=false

# After upgrading to 1.36.0, verify version
docker exec vaultwarden /vaultwarden --version