Authentication Bypass Vulnerability in Bitwarden Server Software

CVE-2026-101878

What is CVE-2026-101878?

Bitwarden Server versions below 2026.5.0 contain a vulnerability involving the handling of the @ExternalId parameter in the User_ReadBySsoUserOrganizationIdExternalId stored procedure. The procedure improperly declares this parameter as NVARCHAR(50), conflicting with the NVARCHAR(300) definition of the column it queries. This leads to a truncation of the SSO login identifier in SQL Server deployments. Consequently, an attacker can exploit this flaw, allowing a user whose identity-provider identifier starts with an existing member's identifier to gain unauthorized access, thereby obtaining a victim-scoped access token. This issue underscores the necessity for precise data type alignment to ensure robust authentication processes.

References