Vulnerability Description
Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.36.0, Vaultwarden's SSO discovery and pre-validation flow returned organization-related SSO metadata including organizationIdentifier values for arbitrary email addresses and allowed a valid pre-validation JWT to be obtained with only the discovered identifier, enabling SSO-enabled organization enumeration and authentication workflow abuse. This issue is fixed in version 1.36.0.
Related Weaknesses (CWE)
References
- https://github.com/dani-garcia/vaultwarden/commit/d297e274a35dccd0f5d935e9d5934e
- https://github.com/dani-garcia/vaultwarden/pull/7163
- https://github.com/dani-garcia/vaultwarden/releases/tag/1.36.0
- https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-hxqh-ff5p-wf
- https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-hxqh-ff5p-wf
FAQ
What is CVE-2026-47159?
CVE-2026-47159 is a documented vulnerability. Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.36.0, Vaultwarden's SSO discovery and pre-validation flow returned organization-related SSO metadata including organizationIden...
How severe is CVE-2026-47159?
CVSS scoring is not yet available for CVE-2026-47159. Check NVD for updates.
Is there a patch for CVE-2026-47159?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.