CVE-2026-43640

The record

Bitwarden Server prior to v2026.4.1 does not require master-password re-authentication when retrieving or rotating an organization's SCIM API key, allowing an authenticated user with SCIM management privileges to obtain the key using only a valid session.

Affected packages

Related vulnerabilities

• CVE-2026-9854 A vulnerability exists in SYS600 RBAC mechanism where users having access to the… CWE-303
• CVE-2026-9853 A vulnerability exists in SYS600 which allows any user authenticated to the operating… CWE-303
• CVE-2026-49467 Pingvin Share X is a secure and easy self-hosted file sharing platform. CWE-303
• CVE-2026-66411 DEEBOT PRO M1 and DEEBOT PRO K1VAC incorrectly implement authentication algorithm in… CWE-303
• CVE-2026-11430 Grav CMS's scheduler-webhook plugin contains an authentication bypass in the webhook… CWE-303
• CVE-2026-10050 In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to… CWE-303
• CVE-2026-59309 VMware vCenter contains an authentication bypass vulnerability in the VMware Directory… CWE-303
• CVE-2026-50360 Incorrect implementation of authentication algorithm in Windows SMB Server allows an… CWE-303