This vulnerability is caused by the Bitwarden Server stored procedure User_ReadBySsoUserOrganizationIdExternalId declaring its @ExternalId parameter as NVARCHAR(50) while the database column stores NVARCHAR(300). On SQL Server deployments the external identifier is silently truncated to 50 characters; an attacker whose identity-provider identifier begins with another user’s full 50‑character identifier can authenticate as that user and receive a victim‑scoped access token, effectively bypassing authentication and compromising confidentiality and integrity for the victim's data.

All Bitwarden Server deployments using SQL Server and running any version before 2026.5.0 are affected. The issue was introduced in the 2025.6.0 release and remains present in all subsequent releases up to, but not including, 2026.5.0. Deployments that use other database engines are not impacted because the truncation occurs only on SQL Server.

The CVSS score of 7.7 places this vulnerability in the high‑severity range. No EPSS score is available and it is not listed in the CISA KEV catalog. Attackers can exploit the flaw remotely via the standard SSO authentication flow by supplying a crafted external identifier; no additional local access or pre‑existing vulnerabilities are required.