PT-2026-39717 · Bitwarden · Server

Sanjok Karki · Published 2026-05-11 · Updated 2026-05-11 · CVE-2026-43640

Mitre

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Bitwarden Server prior to v2026.4.1 does not require master-password re-authentication when retrieving or rotating an organization's SCIM API key, allowing an authenticated user with SCIM management privileges to obtain the key using only a valid session.

Exploit

Fix

Weakness Enumeration

CWE-303

Related Identifiers

CVE-2026-43640

Affected Products

Server

References · 6

• 🔥 https://sanjokkarki.com.np/blog/bitwarden-scim-key-bypass · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-43640 · Security Note
• https://github.com/bitwarden/server/commit/eb251d9bf80724c87b187661783b9354d1784083 · Patch
• https://vulncheck.com/advisories/bitwarden-server-authentication-bypass-via-scim-api-key · Note
• https://github.com/bitwarden/server/pull/7403 · Note
• https://github.com/bitwarden/server/releases/tag/v2026.4.1 · Note