CVE-2026-57522

Name of the Vulnerable Software and Affected Versions Bitwarden Server versions prior to 2026.5.0

Description An issue exists in the IntegrationTemplateProcessor.ReplaceTokens() function where user-controlled values are substituted into event-integration templates without proper JSON encoding. An authenticated member can exploit this by setting their display name to include JSON metacharacters. This allows the injection of arbitrary key-value pairs into rendered payloads sent to webhook, SIEM, Slack, Teams, or Datadog endpoints. The injected fields are indistinguishable from legitimate template output when tokens such as #ActingUserName# or #UserName# are used.

Recommendations Update Bitwarden Server to version 2026.5.0 or later.