CVE-2026-43911: Vaultwarden: Refresh tokens not invalidated on security stamp rotation
Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.35.5, refresh tokens are not invalidated when the user's securitystamp is rotated by some security-sensitive operations (password change, KDF change, key rotation, email change, org admin password reset, emergency access takeover). This allows an attacker holding a previously obtained refresh token to maintain session access even after the user has taken action to secure their account. This vulnerability is fixed in 1.35.5.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-43911?
CVE-2026-43911 is classified as a medium severity vulnerability due to the potential for unauthorized access stemming from improperly managed refresh tokens.
How do I fix CVE-2026-43911?
To fix CVE-2026-43911, upgrade Vaultwarden to version 1.35.5 or later to ensure refresh tokens are invalidated upon security stamp rotation.
What impact does CVE-2026-43911 have on my system?
CVE-2026-43911 allows an attacker to retain access with potentially stale refresh tokens after critical security changes, increasing the risk of unauthorized access.
Who is affected by CVE-2026-43911?
CVE-2026-43911 affects all users of Vaultwarden versions prior to 1.35.5 who rely on refresh tokens for authentication.
What version of Vaultwarden should I upgrade to in response to CVE-2026-43911?
You should upgrade to Vaultwarden version 1.35.5 or newer to mitigate the risks associated with CVE-2026-43911.