CyberRota Analysis
AI-GeneratedThe vulnerability affects Vaultwarden's SSO authorization flow, where the OAuth state parameter is not securely bound to the initiating browser session, allowing attackers to exploit this weakness through manipulated PKCE parameters. This can lead to unauthorized IdP authentication and token redemption, resulting in a fully authenticated session for the attacker. Organizations using Vaultwarden prior to version 1.36.0 should prioritize updating to the latest version to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.36.0, Vaultwarden's SSO authorization flow did not bind the OAuth state parameter accepted by /connect/authorize to the initiating browser session, allowed attacker-controlled PKCE parameters, and left SsoAuth records intact after failed token exchange, allowing an unauthenticated attacker to induce IdP authentication and redeem tokens for a fully authenticated session. This issue is fixed in version 1.36.0.