Bitwarden Server versions prior to 2026.6.0 allow a low-privileged organization member to forge an admin authentication request by providing an arbitrary email address in the POST /auth-requests/admin-request body. The system does not verify that the supplied email belongs to the caller. This flaw lets the attacker trigger a trusted-device encryption request tied to an attacker-controlled public key, and obtain a vault key and a victim-scoped access token once the request is approved. The vault key is exposed through an unauthenticated endpoint, resulting in the disclosure of sensitive vault secrets and the ability to take over the victim’s account. This is a CWE-639 Authorization Bypass vulnerability.

The vulnerability affects Bitwarden Server (self-hosted) releases earlier than 2026.6.0. Any deployment of Bitwarden Server in the 2026.5.x or earlier track is potentially vulnerable.

The CVSS score of 9.3 indicates a critical severity. Based on the description, it is inferred that the attacker only needs to be a low-privileged organization member with local authenticated access to create the admin authentication request. Because the EPSS score is < 1% and the vulnerability is not listed in CISA’s KEV catalog, the likelihood of exploitation in the wild is presently low. However, the high severity and the straightforward attack path warrant immediate attention. If the application is exposed to the internet, the vulnerability could be leveraged by attackers who first gain initial access through other means; this inference is based on the nature of the flaw requiring only local authenticated access.