CVE-2026-43640: Bitwarden Server

High severity, CVSS 8.1. EPSS: 0.7% chance of exploitation in the next 30 days.

Bitwarden Server prior to v2026.4.1 does not require master-password re-authentication when retrieving or rotating an organization's SCIM API key, allowing an authenticated user with SCIM management privileges to obtain the key using only a valid session.

Affected products

• Bitwarden Server: before 2026.4.1 (fixed in 2026.4.1)

Published 2026-05-11. Last modified 2026-07-14.