CVE-2026-57522: Bitwarden Server < 2026.5.0 JSON Injection via Webhook Templates
Bitwarden Server before 2026.5.0 contains a JSON injection vulnerability in IntegrationTemplateProcessor.ReplaceTokens(), which substitutes user-controlled values into event-integration templates without JSON encoding. When an organization has configured an event integration whose template references a user-controlled token (such as #ActingUserName# or #UserName#, populated from a member's display name), an authenticated member can set their display name to JSON metacharacters and inject arbitrary key-value pairs into the rendered payloads delivered to webhook, SIEM, Slack, Teams, or Datadog endpoints, making injected fields indistinguishable from legitimate template output.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-57522?
The severity of CVE-2026-57522 is classified as low, with a score of 3.5.
How do I fix CVE-2026-57522?
To fix CVE-2026-57522, upgrade to Bitwarden Server version 2026.5.0 or later.
What is the impact of CVE-2026-57522?
CVE-2026-57522 may allow for JSON injection through improperly sanitized user inputs in webhook templates.
In which version of Bitwarden Server was CVE-2026-57522 addressed?
CVE-2026-57522 was addressed in Bitwarden Server version 2026.5.0.
What products are affected by CVE-2026-57522?
CVE-2026-57522 affects Bitwarden Server versions prior to 2026.5.0.