Vaultwarden is a Bitwarden-compatible server written in Rust. In versions earlier than 1.36.0, the SSO login flow checked the IdP email_verified claim only when creating new users, but not when linking an IdP identity to an existing local account while the setting SSO_SIGNUPS_MATCH_EMAIL is enabled. This omission allows an attacker‑controlled IdP to bind an existing account by asserting a victim’s email address. Once the binding is made, the attacker can authenticate as that account and obtain its privileges. The issue is resolved in release 1.36.0.

The vulnerability affects all installations of the Vaultwarden server authored by dani-garcia: vaultwarden at versions prior to 1.36.0. The fix was introduced in release 1.36.0 and commit d297e274a35dccd0f5d935e9d5934e0f7e9c0a87.

The CVSS score of 7.7 indicates a high severity issue, while the EPSS score of less than 1% shows exploitation is unlikely in the wild at this time. The vulnerability is not listed in the CISA KEV catalog, which further suggests limited current exploitation. The attack vector is remote and occurs through the SSO login flow; an attacker needs control over an IdP or the ability to craft IdP responses that claim a victim’s email address. Based on the description, it is inferred that once the attacker binds an IdP identity to an existing account, they would obtain that account’s privileges without needing to compromise the victim or the server’s credentials.