PT-2026-102434
CVE-2026-101878
·
تاريخ النشر
2026-09-29
·
تاريخ التحديث
2026-09-29
الوصف من
CVSS 4.0
7.7
عاليةالمقاييسAV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Name of the Vulnerable Software and Affected Versions
Bitwarden Server versions 2025.6.0 through 2026.4.x
Description
In SQL Server deployments, the stored procedure
User ReadBySsoUserOrganizationIdExternalId() declares the @ExternalId parameter as NVARCHAR(50), whereas the queried column uses NVARCHAR(300). This discrepancy causes the SSO login identifier to be silently truncated. Consequently, a user whose identity-provider identifier starts with the full 50-character identifier of another organization member can authenticate as that member and obtain a victim-scoped access token.Recommendations
Update Bitwarden Server to version 2026.5.0 or later.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾