Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to version 1.36.0, its SSO discovery and pre-validation flow returned organization-related SSO metadata, including organizationIdentifier values, for arbitrary email addresses. This flow also allowed an attacker to obtain a valid pre-validation JWT using only the discovered identifier, enabling organization enumeration and abuse of the authentication workflow. The flaw is classified as CWE-287.

The affected product is Vaultwarden published by dani-garcia. All releases older than 1.36.0 are vulnerable; the issue is fixed in 1.36.0 and later.

The CVSS score of 6.9 indicates a moderate severity. The EPSS score is below 1%, suggesting a low probability of exploitation. Vaultwarden is not listed in the CISA KEV catalog, so no public exploits have been recorded. The likely attack vector is remote, requiring network access to the SSO discovery endpoint; no privilege escalation or local access is required. Once the vulnerability is triggered, an attacker can enumerate all organizations that register email addresses with the service and then use the valid pre-validation JWT to impersonate users or gain access to protected resources.