Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
Bitwarden Server before 2026.6.0 does not verify that the email in a POST /auth-requests/admin-request body belongs to the authenticated caller, allowing a low-privileged organization member to obtain another user's vault key and a victim-scoped access token by creating a Trusted Device Encryption authentication request, bound to an attacker-controlled public key, that is readable from an unauthenticated endpoint once approved resulting in disclosure of the victim's vault key and account takeover.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-07-09 | 3 | Patch2PoC1 |
| 2026-07-10 | 1 | Patch1 |
| 2026-07-11 | 1 | PoC1 |
| 2026-07-15 | 1 | Disclosure1 |
| 2026-07-20 | 1 | Disclosure1 |
Warning: Auth Bypass in #Bitwarden Server lets a low-priv org member steal other users' vaults! CVE-2026-60104 CVSS: 9.3. Update to v2026.6.0+ now! #Patch #Patch #Patch
Post summary
The message warns about a high‑severity auth bypass in Bitwarden Server (CVE‑2026‑60104, CVSS 9.3) and urges users to update to the patched version v2026.6.0+.
Bitwarden Server - Critical vulnerability in Bitwarden Server URL: https://www.cve.org/CVERecord?id=CVE-2026-60104 Classification: Critical, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv4.0: 9.3
Post summary
Bitwarden Server is affected by a critical vulnerability (CVE-2026-60104) with a CVSSv4.0 score of 9.3. An official fix is available, and there is no indication of active exploitation or a PoC.
🚨 CRITICAL: CVE-2026-60104 — Bitwarden Server Auth Bypass CVSS 8.7. Low-privileged users can steal vault keys and take over accounts via TDE admin request. Patch to 2026.6.0 NOW. → http://threataft.com/articles/cve-2026-60104-bitwarden-server-auth-bypass-vault-theft #cybersecurity #infosec #Bitwarden
Post summary
The text announces a critical Bitwarden Server authentication bypass (CVE-2026-60104), shares its CVSS score and brief technical details, and urges users to apply the 2026.6.0 patch.
⚠️ Vulnerabilidad en productos Bitwarden ❗ CVE-2026-60104 ➡️ Más info: https://www.cert.gov.py/vulnerabilidad-en-productos-bitwarden-2/ https://t.co/DM7gC0UF6w
Post summary
The tweet announces a newly discovered vulnerability (CVE-2026-60104) in Bitwarden products, linking to external resources for details, but it does not provide a PoC, exploit code, active exploitation evidence, patches, or technical specifics.
A public exploit dropped this week for self-hosted @Bitwarden Server (CVE-2026-60104): a low-privileged member could request other people’s vault keys through the Trusted Device Enrollment approval flow, and walk off with them. Nobody broke the crypto. The vault did exactly what it was built to do. It delivered the keys to whoever the workflow approved. @Bitwarden patched it in a day. The real question is why a vault holds a key it can hand out at all 👇 https://x.com/clavitorai/status/2075889206627324203
Post summary
A public exploit for CVE‑2026‑60104 enabling low‑privileged users to retrieve vault keys was released, and Bitwarden issued a patch within a day.
Bitwarden protects some of the most sensitive assets in an organization: passwords, vault keys, tokens, and privileged credentials. CVE-2026-60104 is a reminder that password management platforms must be patched and monitored with the same urgency as any other critical security system. For organizations running Bitwarden Server, prioritize these actions now: - Upgrade to Bitwarden Server 2026.6.0 or later immediately - Review organization members, admin roles, trusted device settings, and authentication request activity - Audit logs for unusual admin-request activity, unexpected device approvals, or suspicious token usage - Rotate credentials, vault access, API keys, and recovery workflows if compromise is suspected - Enforce MFA, least privilege, and strict approval processes for privileged accounts - Educate users to verify authentication and trusted-device requests before approving 𝗩𝗶𝘀𝘁𝗲𝗺 𝗘𝗹𝗲𝘃𝗮𝘁𝗲 𝗽𝗼𝘄𝗲𝗿𝗲𝗱 𝗯𝘆 𝗩𝗶𝘀𝘁𝗲𝗺𝗦𝗲𝗰𝘂𝗿𝗲𝗣𝗿𝗼 helps organizations strengthen identity security, reduce credential risk, and improve compliance readiness with vCISO-led strategy, continuous monitoring, and measurable outcomes. Contact: sales@vistem.com | http://www.vistem.com?utm_source=in_page&utm_medium=Vistem+Solutions%2C+Inc.&utm_campaign=publer #Cybersecurity #Bitwarden #PasswordSecurity #CVE #VulnerabilityManagement #IdentitySecurity #CredentialTheft #MFA #IncidentResponse #CyberResilience #VistemElevate #VistemSecurePro #VistemSolutions #SecurityCompliance https://feedly.com/cve/CVE-2026-60104?utm_source=in_page&utm_medium=Vistem+Solutions%2C+Inc.&utm_campaign=publer
Post summary
CVE-2026-60104 affects Bitwarden and the advisory urges users to upgrade to version 2026.6.0 or later, rotate credentials and enforce MFA to mitigate risk.
csirt_it: #Bitwarden: #PoC pubblico per la vulnerabilità identificata tramite la CVE-2026-60104 Rischio: 🔴 Tipologia: 🔸 Security Restrictions Bypass 🔸 Information Leakage 🔗 https://www.acn.gov.it/portale/w/bitwarden-poc-pubblico-per-lo-sfruttamento-di-una-nuova-vulnerabilita ⚠ Importante mantenere aggiornati i sistemi https://t.co/PqPNcbEYpG
Post summary
The tweet announces a public PoC for CVE-2026-60104 in Bitwarden, highlighting a security restrictions bypass and information leakage, and urges users to keep their systems updated.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | bitwarden | server | - | - | - |