CVE-2026-60104: Bitwarden Server Auth Bypass Vulnerability

CVE-2026-60104 Overview

CVE-2026-60104 is a critical authorization bypass vulnerability in Bitwarden Server versions before 2026.6.0. The flaw resides in the POST /auth-requests/admin-request endpoint, which fails to verify that the email in the request body belongs to the authenticated caller. A low-privileged organization member can create a Trusted Device Encryption authentication request bound to an attacker-controlled public key on behalf of a victim user. Once approved, the request is readable from an unauthenticated endpoint, disclosing the victim's vault key and a victim-scoped access token. The result is complete account takeover and vault decryption. The issue is tracked as CWE-639: Authorization Bypass Through User-Controlled Key.

Critical Impact
A low-privileged organization member can obtain another user's vault key and a scoped access token, resulting in full account takeover and disclosure of stored secrets.

Affected Products

Bitwarden Server versions prior to 2026.6.0
Self-hosted Bitwarden deployments using Trusted Device Encryption
Bitwarden organizations with Admin Approval device authentication enabled

Discovery Timeline

2026-07-08 - CVE-2026-60104 published to the National Vulnerability Database (NVD)
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-60104

Vulnerability Analysis

The vulnerability is an authorization bypass in the Bitwarden authentication request workflow. The PostAdminRequest action in AuthRequestsController.cs accepts an AuthRequestCreateRequestModel containing an arbitrary email field. The server resolves the target user from the supplied email without confirming that email matches the authenticated caller. Any organization member can therefore create an authentication request on behalf of any other member.

The attacker supplies their own public key inside the request. When an organization admin approves the auth request through the Trusted Device Encryption flow, the victim's vault key is encrypted to the attacker-controlled public key. The approved auth request is then retrievable from an unauthenticated response endpoint, allowing the attacker to decrypt the vault key and receive a victim-scoped access token.

Root Cause

The root cause is missing owner verification between the authenticated principal and the email parameter in the request body. The CreateAuthRequestAsync service method resolved a user record from the request payload but never compared user.Id against _currentContext.UserId. Combined with the fact that AdminApproval responses can be fetched anonymously, the missing check enables cross-account request forgery within a single organization.

Attack Vector

The attack is network-based and requires only low privileges (organization membership). Exploitation requires an administrator to approve the crafted request, satisfying the user-interaction condition. Successful exploitation grants read access to the victim's vault contents and enables account takeover.

csharp

// Patched controller check in src/Api/Auth/Controllers/AuthRequestsController.cs
[HttpPost("admin-request")]
public async Task<AuthRequestResponseModel> PostAdminRequest([FromBody] AuthRequestCreateRequestModel model)
{
    if (model.Type != AuthRequestType.AdminApproval)
    {
        throw new BadRequestException("Invalid AuthRequestType. Expected AdminApproval.");
    }

    var authRequest = await _authRequestService.CreateAuthRequestAsync(model);
    var r = new AuthRequestResponseModel(authRequest, _globalSettings.BaseServiceUri.Vault);
    return r;
}

// Patched ownership check in src/Core/Auth/Services/Implementations/AuthRequestService.cs
// Ensure authenticated user id matches target user (allows anon scenarios still)
if (_currentContext.UserId.HasValue && user!.Id != _currentContext.UserId.Value)
{
    throw new BadRequestException("User or known device not found.");
}

Source: Bitwarden Server security commit dcf4c48

Detection Methods for CVE-2026-60104

Indicators of Compromise

POST /auth-requests/admin-request requests where the JSON body email field does not match the authenticated user's email
Unexpected AdminApproval auth requests targeting users who did not initiate a device login
Unauthenticated GET /auth-requests/{id}/response fetches shortly after an admin approval event
New or unrecognized public keys appearing in approved auth request payloads

Detection Strategies

Parse Bitwarden application logs and correlate the authenticated userId on admin-request calls with the email value inside the request body; alert on mismatches
Alert on any organization member submitting multiple admin-request payloads targeting distinct email addresses within a short window
Monitor for approvals of admin auth requests immediately followed by anonymous polling of the response endpoint from the same source IP

Monitoring Recommendations

Enable verbose audit logging on the Auth controllers and forward events to a centralized SIEM
Track and baseline the volume of AdminApproval requests per organization member per day
Review admin approval workflows and require out-of-band verification for device login approvals until patched

How to Mitigate CVE-2026-60104

Immediate Actions Required

Upgrade all self-hosted Bitwarden Server instances to version 2026.6.0 or later, which contains the fix in commit dcf4c48
Audit approved admin auth requests from before the upgrade for suspicious public keys or unexpected target users
Rotate vault keys and master passwords for any accounts identified in suspicious admin-request events
Temporarily disable Trusted Device Encryption Admin Approval in organizations that cannot patch immediately

Patch Information

The fix is delivered in Bitwarden Server release v2026.6.0. It is implemented in commit dcf4c486b2b5bedecc03a48b427243328cc74a9a via pull request PR #7615. The patch enforces that the request type is AdminApproval and that the resolved target user matches the authenticated caller. Additional analysis is available in the VulnCheck advisory and the Vault Key Heist blog.

Workarounds

Disable the Admin Approval device authentication option in organization policies until the upgrade is applied
Restrict organization membership provisioning and review existing low-privilege accounts for suspicious behavior
Block access to /auth-requests/admin-request at the reverse proxy for untrusted network segments where feasible

bash

# Upgrade a self-hosted Bitwarden deployment to the patched release
./bitwarden.sh updateself
./bitwarden.sh update

# Verify the running version matches the patched release
docker exec -it bitwarden-api cat /etc/bitwarden/version
# Expected: 2026.6.0 or later