Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Bitwarden bug bounty programs

bitwarden.com Updated

Bitwarden runs one public program: a HackerOne disclosure program with no cash rewards.

Top reward
No cash
Disclosure only
Programs
1
None pays cash
Targets in scope
21
6 types
Last change
None yet
Tracked since Nov 2026

Where to report

The one public program Bitwarden runs.

  • Bitwarden

    HackerOne · Disclosure only

    Open

    Top reward

    No cash
    First response
    19 hours average

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

What is in scope

21 targets. 8 excluded.

  • api.bitwarden.com

    Web Critical No bounty

  • bitwarden.com

    Web Critical No bounty

  • docs.passwordless.dev

    Web Critical No bounty

  • help.bitwarden.com

    Web Critical No bounty

  • identity.bitwarden.com

    Web Critical No bounty

  • v4.passwordless.dev

    Web Critical No bounty

  • vault.bitwarden.com

    Web Critical No bounty

  • com.bitwarden.authenticator

    Android Critical No bounty

  • com.x8bit.bitwarden

    Android Critical No bounty

  • com.8bit.bitwarden

    iOS Critical No bounty

  • https://github.com/bitwarden

    Source code Critical No bounty

  • https://github.com/bitwarden/android

    Source code Critical No bounty

  • https://github.com/bitwarden/clients

    Source code Critical No bounty

  • https://github.com/bitwarden/ios

    Source code Critical No bounty

  • https://github.com/bitwarden/sdk-internal

    Source code Critical No bounty

  • https://github.com/bitwarden/server

    Source code Critical No bounty

  • 9pjsdv0vpk04

    Desktop and binaries Critical No bounty

  • https://addons.mozilla.org/en-US/firefox/addon/bitwarden-password-manager/

    Products and areas Critical No bounty

  • https://addons.opera.com/extensions/details/bitwarden-free-password-manager/

    Products and areas Critical No bounty

  • https://safari-extensions.apple.com/details/?id=com.bitwarden.safari-LTZ2PFU5D6

    Products and areas Critical No bounty

  • https://www.npmjs.com/package/@bitwarden/mcp-server

    Products and areas Critical No bounty

No target matches. Try part of a host name, such as the company name.

Out of scope 8

Don't test these. A program can exclude a host another program covers; the program you report to decides.

  • https://github.com/bitwarden/.github

  • https://github.com/bitwarden/agent-access

  • https://github.com/bitwarden/akd-watch

  • https://github.com/bitwarden/autopush-manager

  • https://github.com/bitwarden/bitwarden-russh

  • https://github.com/bitwarden/passwordless-react-example

  • https://github.com/bitwarden/phishing-test-page

  • https://github.com/bitwarden/rotation-daemon

Recent changes

Reward and scope changes across every Bitwarden program, newest first.

No changes recorded yet. New targets and reward moves show up here and in the RSS feed.

Recent CVEs

Published vulnerabilities in Bitwarden products, from the NVD.

Search NVD
  • CVE-2026-60104 Critical

    Bitwarden Server before 2026.6.0 does not verify that the email in a POST /auth-requests/admin-request body belongs to the authenticated caller, allowing a low-privileged organization member to obtain another user's vault key and a victim-scoped access token by creating a Trusted Device Encryption authentication request, bound to an attacker-controlled public key, that is readable from an unauthen

  • CVE-2026-57520 High

    Bitwarden Server before 2026.5.0 contains a privilege escalation vulnerability that allows authenticated Custom users with ManageUsers permission to remove Admin accounts from an organization by exploiting a missing role hierarchy check in the bulk user-remove endpoint. Attackers can supply Admin organization-user IDs in a bulk DELETE request to bypass the guard enforced on the single-user removal

  • CVE-2026-57521 Medium

    Bitwarden Server before 2026.5.0 contains a broken access control vulnerability that allows any authenticated user to access arbitrary organization billing data by supplying an arbitrary organizationId to the PreviewInvoiceController endpoints without membership or authorization checks. Attackers can exploit the missing ManageOrganizationBillingRequirement on the preview invoice endpoints to retri

  • CVE-2026-57522 Low

    Bitwarden Server before 2026.5.0 contains a JSON injection vulnerability in IntegrationTemplateProcessor.ReplaceTokens(), which substitutes user-controlled values into event-integration templates without JSON encoding. When an organization has configured an event integration whose template references a user-controlled token (such as #ActingUserName# or #UserName#, populated from a member's display

  • CVE-2026-43638 Medium

    Bitwarden Server prior to v2026.4.1 contains a missing authorization vulnerability that allows any authenticated user to write ciphers into an arbitrary organization via `POST /ciphers/import-organization` by submitting an empty `collections` array, which causes the server-side permission check to be skipped.

  • CVE-2026-43639 High

    Bitwarden Server prior to v2026.4.0 contains a missing authorization vulnerability that allows a provider service user to add an arbitrary organization to their provider via `POST /providers/{providerId}/clients/existing`, resulting in takeover of the target organization; self-hosted installations are unaffected as this endpoint is restricted to Cloud via SelfHosted(NotSelfHostedOnly = true).

  • CVE-2026-43640 High

    Bitwarden Server prior to v2026.4.1 does not require master-password re-authentication when retrieving or rotating an organization's SCIM API key, allowing an authenticated user with SCIM management privileges to obtain the key using only a valid session.

  • CVE-2026-42994 High

    Bitwarden CLI 2026.4.0 from 2026-04-22T21:57Z to 2026-04-22T23:30Z, when obtained from npm, had embedded malicious code. This is related to a Checkmarx supply chain incident.

About this page

This page gathers every public program listed under bitwarden.com: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.

Something wrong or missing? Report a correction.