Answer in brief
CVE-2026-60104 records a Critical severity (CVSS 9.3) vulnerability in Bitwarden Server < 2026.6.0 Authorization Bypass via Admin Auth Request. The current sources do not mark it as known exploited. The current feed maps bitwarden/server (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 9.3. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps bitwarden/server (generic). Check affected ranges and fixed versions before updating.
| Product | Affected versions | Fixed versions |
|---|---|---|
| cpe:2.3:a:bitwarden:server:*:*:*:*:*:*:*:* | Not reported | Not reported |
| Package | Affected range | Fixed version |
|---|---|---|
| bitwarden/servergeneric | * | Not reported |
Published upstream
Jul 8, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Nov 8, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jul 8, 2026
Bitwarden Server before 2026.6.0 does not verify that the email in a POST /auth-requests/admin-request body belongs to the authenticated caller, allowing a low-privileged organization member to obtain another user's vault key and a victim-scoped access token by creating a Trusted Device Encryption authentication request, bound to an attacker-controlled public key, that is readable from an unauthenticated endpoint once approved resulting in disclosure of the victim's vault key and account takeover.
Quoted source text, attributed separately from HOL analysis.