PT-2026-52576 · Bitwarden · Server

Sanjok Karki · Publicado 2026-06-25 · Atualizado 2026-06-25 · CVE-2026-57522

Mitre

CVSS v3.1

3.5

Baixa

Vetor base

AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N

Bitwarden Server before 2026.5.0 contains a JSON injection vulnerability in IntegrationTemplateProcessor.ReplaceTokens(), which substitutes user-controlled values into event-integration templates without JSON encoding. When an organization has configured an event integration whose template references a user-controlled token (such as #ActingUserName# or #UserName#, populated from a member's display name), an authenticated member can set their display name to JSON metacharacters and inject arbitrary key-value pairs into the rendered payloads delivered to webhook, SIEM, Slack, Teams, or Datadog endpoints, making injected fields indistinguishable from legitimate template output.

Exploit

Correção

Special Elements Injection

Enumeração de Fraquezas

CWE-74

Identificadores relacionados

CVE-2026-57522

Produtos afetados

Server

Referências · 6

• 🔥 https://sanjokkarki.com.np/blog/bitwarden-webhook-json-injection · Exploit
• https://github.com/bitwarden/server/pull/7593 · Nota
• https://github.com/bitwarden/server/releases/tag/v2026.5.0 · Nota
• https://github.com/bitwarden/server/commit/a26afd18130ef985ede5c97d277820d045185a28 · Correção
• https://vulncheck.com/advisories/bitwarden-server-json-injection-via-webhook-templates · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-57522 · Nota de Segurança