Security readout for executives and security teams
Plain-English summary
Bitwarden Server before v2026.4.1 could let a signed-in user with SCIM management privileges retrieve or rotate an organization's SCIM API key without re-entering their master password. This weakens a sensitive control around identity provisioning secrets and could expose high-value organizational access paths.
Executive priority
Prioritize remediation for self-hosted Bitwarden Server environments using SCIM. This is high severity because it concerns access to provisioning secrets, but the known precondition is an authenticated user with specific privileges.
Technical view
The flaw is an authentication bypass in Bitwarden Server's SCIM API key retrieval or rotation flow. Sources state master-password re-authentication was not required, so a valid authenticated session with SCIM management privileges could access the organization's SCIM API key. CVSS v4.0 score is 8.6 high.
Likely exposure
Exposure is most relevant to organizations running Bitwarden Server before v2026.4.1 where users have SCIM management privileges. The provided sources do not establish impact for Bitwarden cloud, non-server deployments, or environments without SCIM management use.
Exploitation context
Public technical analysis is referenced, but the bundle does not state active exploitation and KEV is false. Exploitation requires a valid authenticated session and SCIM management privileges, not unauthenticated internet access.
Researcher notes
The key research point is the missing master-password re-authentication gate around SCIM API key access. Evidence supports a privilege-scoped authentication bypass, not unauthenticated compromise. Do not assume active exploitation without further source confirmation.
Mitigation direction
- Upgrade Bitwarden Server to v2026.4.1 or later.
- Review Bitwarden's v2026.4.1 release notes and patch details.
- Restrict SCIM management privileges to users who require them.
- Check vendor guidance before rotating keys or changing SCIM integrations.
- Review privileged session security for affected organizations.
Validation and detection
- Inventory Bitwarden Server instances and record deployed versions.
- Confirm whether each instance is older than v2026.4.1.
- Identify organizations using SCIM management features.
- Review which users hold SCIM management privileges.
- Check administrative logs for SCIM key retrieval or rotation activity.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-303: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCredential and access behavior lookup
The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-43640 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.6 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N——VulnCheckCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N2.85.2VulnCheckVulnerability scoring details
Base CVSS 4.0 score
8.6HighVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Base CVSS 3.1 score
8.1HighVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://sanjokkarki.com.np/blog/bitwarden-scim-key-bypassCVE reference, VulnCheck · technical-description, exploit
- https://github.com/bitwarden/server/releases/tag/v2026.4.1CVE reference, VulnCheck · release-notes
- https://github.com/bitwarden/server/pull/7403CVE reference, VulnCheck · issue-tracking
- https://github.com/bitwarden/server/commit/eb251d9bf80724c87b187661783b9354d1784083CVE reference, VulnCheck · patch
- https://www.vulncheck.com/advisories/bitwarden-server-authentication-bypass-via-scim-api-keyCVE reference, VulnCheck · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Incorrect Implementation of Authentication Algorithm
Incorrect Implementation of Authentication Algorithm represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.