PT-2026-39861 · Unknown · Vaultwarden

Qaz741Wsd856 · CVE-2026-43911 · Published 2026-05-11 · Updated 2026-05-12

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Vaultwarden versions prior to 1.35.5

Description Refresh tokens are not invalidated when a user's security stamp is rotated during security-sensitive operations, such as password changes, KDF changes, key rotation, email changes, organization administrator password resets, or emergency access takeovers. This allows an attacker with a previously obtained refresh token to maintain session access even after the user has performed actions to secure their account.

Recommendations Update to version 1.35.5.

Exploit

Fix

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

CVE-2026-43911

GHSA-6J4W-G4JH-XJFX

Affected Products

Vaultwarden

References · 6

• 🔥 https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-6j4w-g4jh-xjfx · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/43xxx/CVE-2026-43911.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-43911 · Security Note
• https://osv.dev/vulnerability/CVE-2026-43911 · Vendor Advisory
• https://t.me/CVEtracker/53433 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2054161372401791484 · Twitter Post