Advisories · Technology
dani-garcia vaultwarden.
Every CVE that names dani-garcia vaultwarden among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 5.8 Medium
Vaultwarden: Icon endpoint SSRF fix bypass via second-stage favicon IP literal URLs
- dani-garcia vaultwarden
- Server-side request forgery (SSRF)
- CVSS 8.6 High
Vaultwarden through 1.37.3 Authorization Bypass via Missing Status Check
- dani-garcia vaultwarden
- Broken access control
- CVSS 5.8 Medium
Vaultwarden: Server-side request forgery (SSRF) via Icon Endpoint Decimal/Hex/Octal IP Bypass
- dani-garcia vaultwarden
- Server-side request forgery (SSRF)
- CWE-1389
- CVSS 7.7 High
Vaultwarden: SSO Email Auto-Link Can Bind an Existing Local Account to an Attacker-Controlled IdP Identity
- dani-garcia vaultwarden
- Broken access control
- CVSS 6.9 Medium
Vaultwarden: Authentication Flow Information Disclosure in SSO Discovery Allows Organization Enumeration and Pre-Validation Token Exposure
- dani-garcia vaultwarden
- Authentication bypass
- CVSS 8.3 High
Vaultwarden: CSRF in SSO Authorization Flow
- dani-garcia vaultwarden
- Cross-site request forgery (CSRF)
- CVSS 7.3 High
Vaultwarden: Brute-force protection bypass vulnerability
- dani-garcia vaultwarden
- Authentication bypass
- CVSS 8.1 High
Vaultwarden: Unconfirmed Owner Can Purge Entire Organization Vault
- dani-garcia vaultwarden
- Broken access control
- CVSS 8.7 High
Vaultwarden: Cross-Org Group Binding Enables Unauthorized Read And Write Access Into Another Organization
- dani-garcia vaultwarden
- Broken access control
- CVSS 6.8 Medium
Vaultwarden: Refresh tokens not invalidated on security stamp rotation
- dani-garcia vaultwarden
- Authentication bypass
- CVSS 5.3 Medium
Vaultwarden missing authorization check allows Manager-role users to enumerate all collections
- dani-garcia vaultwarden
- Broken access control
- CVSS 5.3 Medium
Vaultwarden WebAuthn credential metadata tampered before signature verification
- dani-garcia vaultwarden
- CWE-345
- CVSS 6.5 Medium
vaultwarden has Full Cipher Enumeration Ignoring Organization Collection Permissions
- dani-garcia vaultwarden
- Broken access control
- CVSS 8.1 High
vaultwarden allows escalation of privilege via variable confusion in OrgHeaders trait
- dani-garcia vaultwarden
- Broken access control
- CVSS 7.2 High
vaultwarden allows RCE in the admin panel
- dani-garcia vaultwarden
- Other injection
- CVSS 7.6 High
Privilege escalation allows organization groups to be updated/deleted if their UUID is known in vaultwarden
- dani-garcia vaultwarden
- Privilege escalation
- Broken access control