Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.35.5, refresh tokens are not invalidated when the user's security_stamp is rotated by some security-sensitive operations (password change, KDF change, key rotation, email change, org admin password reset, emergency access takeover). This allows an attacker holding a previously obtained refresh token to maintain session access even after the user has taken action to secure their account. This vulnerability is fixed in 1.35.5.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-43911 Refresh Token Not Invalidated on Security Stamp Rotation in Vaultwarden Before 1.35.5 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-43911
Post summary
The post announces a discovered flaw in Vaultwarden (prior to 1.35.5) where refresh tokens are not invalidated during security stamp rotation, indicating a potential authentication issue.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | dani-garcia | vaultwarden | - | - | - |