CVE-2026-101878: Bitwarden Server 2025.6.0 < 2025.6.0 Authentication Bypass via SSO Identifier Truncation
Bitwarden Server 2025.6.0 before 2026.5.0 declares the @ExternalId parameter of the UserReadBySsoUserOrganizationIdExternalId stored procedure as NVARCHAR(50) while the column it queries stores NVARCHAR(300), silently truncating the SSO login identifier on SQL Server deployments and allowing a user whose identity-provider identifier begins with another organization member's full 50-character identifier to authenticate as that member and obtain a victim-scoped access token.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected by this issue?
The issue affects Bitwarden Server deployments using SQL Server, because the vulnerable stored procedure truncates the SSO identifier parameter there. The described affected range is versions before 2026.5.0.
What must an attacker have to exploit the bypass?
The attacker needs an identity-provider identifier whose value begins with another organization member's complete 50-character identifier. Successful exploitation allows authentication as that member and issuance of a victim-scoped access token.
How can administrators determine whether they are exposed?
Check whether the Bitwarden Server deployment uses SQL Server, is running a version before 2026.5.0, and uses SSO identities. Exposure depends on identifiers being compared through the vulnerable procedure, where the supplied identifier is truncated to 50 characters.
What should be done if an affected deployment cannot be upgraded immediately?
The provided information does not identify a workaround or mitigation other than updating to a version that fixes the affected stored procedure.