CVE-2026-47158

Name of the Vulnerable Software and Affected Versions Vaultwarden versions prior to 1.36.0

Description The SSO authorization flow fails to bind the OAuth state parameter accepted by the '/connect/authorize' endpoint to the initiating browser session. Additionally, the system allows attacker-controlled PKCE (Proof Key for Code Exchange) parameters and retains SsoAuth records after a failed token exchange. These flaws enable an unauthenticated attacker to induce Identity Provider (IdP) authentication and redeem tokens to obtain a fully authenticated session.

Recommendations Update to version 1.36.0.