Compliance Impact

This vulnerability allows an attacker holding a previously obtained refresh token to maintain session access even after the user has taken security-sensitive actions to secure their account, such as password changes or key rotations.

Such unauthorized persistent access could lead to unauthorized data exposure or modification, which may impact compliance with standards and regulations like GDPR and HIPAA that require strict access controls and timely revocation of credentials after security events.

However, specific impacts on compliance are not detailed in the provided information.

Useful 0 Not Useful 0

Executive Summary

This vulnerability affects Vaultwarden, a Bitwarden-compatible server. Before version 1.35.5, when a user performs security-sensitive operations such as changing their password, key derivation function (KDF), key rotation, email change, organization admin password reset, or emergency access takeover, the refresh tokens are not invalidated. This means that an attacker who has previously obtained a refresh token can continue to use it to maintain session access even after the user has taken steps to secure their account.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability allows an attacker with a previously obtained refresh token to maintain unauthorized access to a user's session despite the user performing security-sensitive actions intended to secure their account. This can lead to continued unauthorized access to sensitive information stored in Vaultwarden, potentially compromising user data confidentiality and integrity.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade Vaultwarden to version 1.35.5 or later, where the issue with refresh tokens not being invalidated after security-sensitive operations is fixed.

Useful 0 Not Useful 0