Bitwarden Server prior to version 2026.5.0 contains a JSON injection flaw in the IntegrationTemplateProcessor.ReplaceTokens() method. The method substitutes user-controlled values into event‑integration templates without proper JSON encoding, allowing an authenticated member to set their display name to JSON metacharacters. By doing so, the member can inject arbitrary key‑value pairs into the payloads that are sent to webhook, SIEM, Slack, Teams, or Datadog endpoints, making the injected fields indistinguishable from legitimate template output. This flaw corresponds to CWE-74 and can result in unintended data exposure or manipulation through external integrations.

The vulnerability affects all Bitwarden Server installations where the version is earlier than 2026.5.0. Any deployment that relies on event integration templates referencing user‑controlled tokens is potentially impacted.

The CVSS score is 2.3, indicating a low overall severity. The EPSS score is not available and the flaw is not listed in the CISA KEV catalog. Exploitation requires an authenticated user with permission to template that references a user token such as #ActingUserName# or #UserName#. A successful attack would result in arbitrary data being injected into the payloads sent to third‑party endpoints, potentially breaching confidentiality or causing downstream systems to misinterpret data. Because the flaw does not allow remote code execution or privilege escalation, the risk remains relatively contained yet requires timely mitigation.