Bitwarden Server implementations older than version 2026.4.1 allow an authenticated user with SCIM management privileges to retrieve or rotate an organization’s SCIM API key without requiring re‑authentication to the master password. This flaw effectively bypasses an authentication step, giving an attacker control over the key that can be used to impersonate users or provision accounts through the SCIM endpoint. The vulnerability enables an attacker to compromise an organization’s identity federation without any further exploitation steps.

Any Bitwarden Server installation running a release version earlier than 2026.4.1 is affected. The product is Bitwarden Server, and the flaw applies to all installations that have enabled SCIM and granted management privileges to users. No specific patch versions beyond 2026.4.1 are mentioned as being vulnerable.

The CVSS score of 8.6 categorizes the issue as high severity. While no EPSS value is available and the vulnerability is not listed in the CISA KEV catalog, the attack vector requires an authenticated session with SCIM privileges; therefore the risk is primarily for internal attackers or compromised accounts. Once the key is extracted, the attacker can act with the permissions granted to that key, potentially creating or deleting users, provisioning applications, and impacting the organization’s identity setup.