CVE-2026-47164
Deferred Deferred - Pending Action

SSO Email Verification Bypass in Vaultwarden

Publication date: 2026-07-15

Last updated on: 2026-07-15

Assigner: GitHub, Inc.

Description
Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.36.0, Vaultwarden's SSO login flow checked the IdP email_verified claim only for new-user creation and not when SSO_SIGNUPS_MATCH_EMAIL=true linked an IdP identity to an existing local account, allowing an attacker-controlled IdP identity asserting a victim email address to bind to and authenticate as that account. This issue is fixed in version 1.36.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-15
Last Modified
2026-07-15
Generated
2026-08-05
AI Q&A
2026-07-15
EPSS Evaluated
2026-08-03
NVD
CVE-2026-47164
EUVD
EUVD-2026-44695

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
dani_garcia vaultwarden to 1.36.0 (exc)
dani_garcia vaultwarden 1.36.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Vaultwarden allows an attacker to take over a victim's account by exploiting a flaw in the SSO login flow. The system failed to verify if an email was confirmed by the identity provider (IdP) when linking an existing local account to an SSO identity, even when SSO_SIGNUPS_MATCH_EMAIL=true was set. This enabled attackers to bind their IdP identity to a victim's account using the victim's email address without proper verification.

Detection Guidance

This vulnerability can be detected by checking the Vaultwarden version and SSO configuration. If using version 1.35.8 or earlier with SSO enabled and SSO_SIGNUPS_MATCH_EMAIL=true, the system is vulnerable. Review IdP email verification claims and SSO login logs for suspicious account bindings.

Impact Analysis

If you use Vaultwarden with SSO enabled and have not updated to version 1.36.0, an attacker could gain full access to your encrypted vault data, perform unauthorized actions, and impersonate you. This is especially risky if you lack two-factor authentication (2FA) on your account.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements. Organizations using Vaultwarden must ensure they update to version 1.36.0 to mitigate risks of data breaches and non-compliance.

Mitigation Strategies

Immediately upgrade Vaultwarden to version 1.36.0 or later. Ensure IdP properly reports email_verified claims. If IdP cannot enforce email ownership, disable SSO_SIGNUPS_MATCH_EMAIL. Review SSO logs for unauthorized account bindings and enforce 2FA for all accounts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-47164. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart