CyberRota Analysis
AI-GeneratedVaultwarden versions prior to 1.36.0 are vulnerable due to a flaw in the SSO login flow, which fails to verify the email_verified claim when linking an identity provider (IdP) account to an existing local account. This oversight allows attackers to exploit the system by using a manipulated IdP identity to authenticate as a victim, potentially compromising user accounts. Organizations utilizing Vaultwarden for identity management should prioritize upgrading to version 1.36.0 to mitigate this significant security risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.36.0, Vaultwarden's SSO login flow checked the IdP email_verified claim only for new-user creation and not when SSO_SIGNUPS_MATCH_EMAIL=true linked an IdP identity to an existing local account, allowing an attacker-controlled IdP identity asserting a victim email address to bind to and authenticate as that account. This issue is fixed in version 1.36.0.