PT-2026-39861 · Unknown · Vaultwarden

Qaz741Wsd856 · Published 2026-05-11 · Updated 2026-05-12 · CVE-2026-43911

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Vaultwarden versions prior to 1.35.5

Description Refresh tokens are not invalidated when a user's security stamp is rotated during security-sensitive operations, such as password changes, KDF changes, key rotation, email changes, organization administrator password resets, or emergency access takeovers. This allows an attacker with a previously obtained refresh token to maintain session access even after the user has performed actions to secure their account.

Recommendations Update to version 1.35.5.

Exploit

Fix

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

CVE-2026-43911

Affected Products

Vaultwarden

References · 4

• 🔥 https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-6j4w-g4jh-xjfx · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-43911 · Security Note
• https://twitter.com/VulmonFeeds/status/2054161372401791484 · Twitter Post
• https://t.me/CVEtracker/53433 · Telegram Post