CVE-2026-43640
Bitwarden Server SCIM API Key Exposure Without Re-authentication
Publication date: 2026-05-11
Last updated on: 2026-05-11
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| bitwarden | server | to 2026.4.1 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-303 | The requirements for the product dictate the use of an established authentication algorithm, but the implementation of the algorithm is incorrect. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
CVE-2026-43640 allows an authenticated user with SCIM management privileges to retrieve or rotate an organization's SCIM API key without requiring master-password re-authentication. This bypass of an additional authentication step increases the risk of unauthorized access to sensitive API keys.
Such unauthorized access to sensitive credentials could potentially lead to data breaches or unauthorized data access, which may impact compliance with standards and regulations like GDPR and HIPAA that require strict access controls and protection of sensitive information.
Therefore, this vulnerability weakens the security posture of the affected Bitwarden Server versions and could hinder an organization's ability to meet compliance requirements related to authentication and access management.
Can you explain this vulnerability to me?
CVE-2026-43640 is a security vulnerability in Bitwarden Server versions prior to 2026.4.1 that affects the SCIM API key management. Specifically, the system did not require users to re-authenticate with their master password when retrieving or rotating an organization's SCIM API key. This happened because the code bypassed the master password verification step for SCIM API keys, allowing an authenticated user with SCIM management privileges to obtain or rotate the SCIM API key using only a valid session.
The root cause was a condition in the code that prevented the password verification method from being called for SCIM API keys, effectively skipping the authentication check. This flaw allowed attackers with valid sessions and SCIM privileges to access sensitive API keys without additional authentication.
The issue was fixed by removing the exception for SCIM API keys in the password verification logic, ensuring that all API key operations require proper master password authentication.
How can this vulnerability impact me? :
This vulnerability can have serious security implications because it allows an authenticated user with SCIM management privileges to retrieve or rotate an organization's SCIM API key without re-authenticating with their master password.
If an attacker gains access to a valid session with SCIM privileges, they can exploit this flaw to obtain sensitive SCIM API keys, which could then be used to access or manipulate the organization's identity and access management integrations.
This unauthorized access could lead to further compromise of organizational resources, unauthorized user provisioning or deprovisioning, and potential data breaches.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves bypassing master-password re-authentication when retrieving or rotating SCIM API keys in Bitwarden Server prior to version 2026.4.1. Detection would require monitoring for unauthorized retrieval or rotation of SCIM API keys without master password verification.
Since the vulnerability allows an authenticated user with SCIM management privileges to obtain the SCIM API key using only a valid session, detection could involve auditing API calls to the SCIM API key retrieval or rotation endpoints for unusual activity or access patterns.
No specific commands or detection scripts are provided in the available resources.
What immediate steps should I take to mitigate this vulnerability?
The primary mitigation step is to update Bitwarden Server to version 2026.4.1 or later, where the vulnerability has been fixed by removing the exception that allowed SCIM API keys to bypass master password verification.
Until the update can be applied, restrict access to users with SCIM management privileges and monitor sessions carefully to prevent unauthorized retrieval or rotation of SCIM API keys.