CyberRota Analysis
AI-GeneratedBitwarden Server versions prior to 2026.5.0 are vulnerable due to a mismatch in the length of the @ExternalId parameter in the User_ReadBySsoUserOrganizationIdExternalId stored procedure, which can lead to SQL Server silently truncating SSO login identifiers. This flaw allows attackers to authenticate as other users by exploiting the truncated identifiers, potentially gaining unauthorized access to sensitive data. Organizations using affected Bitwarden Server versions should prioritize patching to mitigate the risk of credential misuse and unauthorized access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Bitwarden Server 2025.6.0 before 2026.5.0 declares the @ExternalId parameter of the User_ReadBySsoUserOrganizationIdExternalId stored procedure as NVARCHAR(50) while the column it queries stores NVARCHAR(300), silently truncating the SSO login identifier on SQL Server deployments and allowing a user whose identity-provider identifier begins with another organization member's full 50-character identifier to authenticate as that member and obtain a victim-scoped access token.