CVE-2026-101878

Name of the Vulnerable Software and Affected Versions Bitwarden Server versions 2025.6.0 through 2026.4.x

Description In SQL Server deployments, the stored procedure User ReadBySsoUserOrganizationIdExternalId() declares the @ExternalId parameter as NVARCHAR(50), whereas the queried column uses NVARCHAR(300). This discrepancy causes the SSO login identifier to be silently truncated. Consequently, a user whose identity-provider identifier starts with the full 50-character identifier of another organization member can authenticate as that member and obtain a victim-scoped access token.

Recommendations Update Bitwarden Server to version 2026.5.0 or later.