dbcve.org
Cross-Site Request Forgery (CSRF)Weakness · CWE-352

CVE-2026-47158

HIGH · 8.3 CVSS v3.1 Published 2026-07-15
Mitigation only
No fix yet — a mitigation exists. There is no fixed release. A documented workaround reduces exposure in the meantime.
See remediation →
90/100
Remediation priority · Urgent
Remotely reachable No privileges 5 weeks old

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.36.0, Vaultwarden's SSO authorization flow did not bind the OAuth state parameter accepted by /connect/authorize to the initiating browser session, allowed attacker-controlled PKCE parameters, and left SsoAuth records intact after failed token exchange, allowing an unauthenticated attacker to induce IdP authentication and redeem tokens for a fully authenticated session. This issue is fixed in version 1.36.0.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · high confidence

Vaultwarden versions before 1.36.0 contain multiple SSO authentication flaws: the OAuth state parameter is not bound to the browser session (allowing CSRF-like attacks), PKCE parameters can be controlled by attackers (breaking authorization code exchange protection), and SsoAuth records persist after failed token exchanges. These combined issues allow an unauthenticated attacker to induce a victim to complete IdP authentication and then redeem the resulting tokens to establish a fully authenticated session as the victim.

MitigationUpgrade Vaultwarden to version 1.36.0 or later. Review SSO configuration and monitor for any unauthorized session creation attempts.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Scope
Unchanged
Confidentiality
Low
Integrity
High
Availability
High

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Check Vaultwarden version
    Access the Vaultwarden admin interface and view the 'About' page, or run 'docker images' to check the image tag, or check the binary/service version via '--version' flag if running as a standalone binary
    Affected if The installed version is earlier than 1.36.0
  2. Determine if SSO authentication is enabled
    Review the Vaultwarden configuration for SSO/OAuth/OIDC settings - check environment variables for SSO_PROVIDERS or similar, or log into the admin interface and navigate to the SSO/Authentication settings section
    Affected if SSO/OAuth/OIDC authentication methods are configured and enabled for user login
  3. Verify OAuth state parameter handling
    Initiate an SSO login flow and inspect the generated authorization URL - check whether the 'state' parameter value is tied to a session cookie or server-side session storage that the browser must present to complete the flow
    Affected if The 'state' parameter is not bound to the initiating browser session and can be replayed from a different browser context
  4. Inspect PKCE parameter acceptance
    During SSO login initiation, attempt to include or modify PKCE parameters (code_challenge, code_challenge_method) in the authorization request and observe whether Vaultwarden accepts attacker-supplied values
    Affected if Vaultwarden accepts PKCE parameters controlled by the client rather than generating and binding them server-side
  5. Check for stale SsoAuth records
    Query the Vaultwarden database for SsoAuth records that were created but never successfully exchanged for tokens - the location depends on the database backend (SQLite, MySQL, PostgreSQL) configured for your instance
    Affected if SsoAuth records persist in the database after failed token exchange attempts, creating opportunities for token hijacking

A user is affected if Vaultwarden is running a version earlier than 1.36.0 AND has SSO/OAuth authentication enabled, with the specific vulnerabilities present in their SSO configuration and database state.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

dbcve · scoped
Mitigation available No clean upgrade yet — mitigate in the meantime
Mitigation

Upgrade Vaultwarden to version 1.36.0 or later. Review SSO configuration and monitor for any unauthorized session creation attempts.

Recommended fix High confidence

1.36.0

  1. Backup your Vaultwarden data directory and configuration files before upgrading
  2. Stop the running Vaultwarden container or service
  3. Pull or install Vaultwarden version 1.36.0 or later
  4. Restart Vaultwarden with the new version
  5. Verify the SSO authorization flow works correctly by testing a login with your identity provider
  6. Confirm the /connect/authorize endpoint now properly binds the OAuth state parameter to the browser session

Generated from the published advisory — verify against the referenced sources before acting.

Have this fixed Scoped from the published advisory
  • Consultation2.0 h
  • Implementation2.0 h
  • Testing3.0 h
  • Review / QA2.0 h
9.0 hours of engineering $1,570
Get help mitigating

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $2,512.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2026-47158 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2026-47158 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data