- Top reward
- No cash rewards
- Top severity paid
- Critical
- Assets in scope
- 21
- Public CVEs
- 14
- Last change
At a glance
What to know before you start testing.
- No cash rewards
- A disclosure program: you report for credit, not money.
- Report on HackerOne
- Submit through the program page.
- Replies within 3 days
- As the policy promises.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What HackerOne lists as the payout for each severity.
This program does not pay cash rewards.
- Response
-
Within 3 days
Time to first response (from report submission): 3 business days
Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
21 assets you may test, 8 excluded.
Web 7
- api.bitwarden.com Critical No bounty
- bitwarden.com Critical No bounty
- docs.passwordless.dev Critical No bounty
- help.bitwarden.com Critical No bounty
- identity.bitwarden.com Critical No bounty
- v4.passwordless.dev Critical No bounty
- vault.bitwarden.com Critical No bounty
Source code 6
- https://github.com/bitwarden Critical No bounty
- https://github.com/bitwarden/android Critical No bounty
- https://github.com/bitwarden/clients Critical No bounty
- https://github.com/bitwarden/ios Critical No bounty
- https://github.com/bitwarden/sdk-internal Critical No bounty
- https://github.com/bitwarden/server Critical No bounty
Android apps 2
- com.bitwarden.authenticator Critical No bounty
- com.x8bit.bitwarden Critical No bounty
Desktop and binaries 1
- 9pjsdv0vpk04 Critical No bounty
iOS apps 1
- com.8bit.bitwarden Critical No bounty
Products and areas 4
- https://addons.mozilla.org/en-US/firefox/addon/bitwarden-password-manager/ Critical No bounty
- https://addons.opera.com/extensions/details/bitwarden-free-password-manager/ Critical No bounty
- https://safari-extensions.apple.com/details/?id=com.bitwarden.safari-LTZ2PFU5D6 Critical No bounty
- https://www.npmjs.com/package/@bitwarden/mcp-server Critical No bounty
Out of scope (8)
- https://github.com/bitwarden/agent-access
- https://github.com/bitwarden/akd-watch
- https://github.com/bitwarden/autopush-manager
- https://github.com/bitwarden/bitwarden-russh
- https://github.com/bitwarden/.github
- https://github.com/bitwarden/passwordless-react-example
- https://github.com/bitwarden/phishing-test-page
- https://github.com/bitwarden/rotation-daemon
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Bitwarden (via HackerOne)'s policy. "We" in these lines means the program, not this site.
While testing
-
Reports must be written in clear, human-comprehensible language with detailed, reproducible steps and an accompanying proof-of-concept.
-
Use the built-in CVSS 3.0 calculator for the severity of your reported finding; do not submit findings with general or undefined severity values.
-
Submit one vulnerability per report, unless you need to chain vulnerabilities to provide impact.
-
Social engineering (e.g. phishing, vishing, smishing) is prohibited.
-
Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service.
-
Only interact with accounts you own or with the explicit permission of the account holder.
-
Please use your `@wearehackerone.com` email alias when signing up for an account.
-
Denial of service
-
Spamming
Not accepted
-
Authorization state and session expiration on bearer tokens e.g. using a still-valid token after authorization changes elsewhere
-
Bugs that are already reported on any of Bitwarden's issue trackers or that we already know of
-
Self-exploitation
-
Bugs/Defects that do not cross a security boundary
-
Username / email enumeration
-
Missing security best practices that do not directly lead to a vulnerability
-
CSV injection
-
Lack of `Secure` / `HTTPOnly` flags on non-sensitive cookies
-
Issues that do not have any impact on the general public
-
Any activity that could lead to the disruption of our service (DoS)
-
Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS
-
Rate limiting or brute-force issues on non-authentication endpoints
-
Issues that require unlikely user interaction
-
Unencrypted authentication tokens
-
KDF count disclosure on the `/prelogin` server API
-
Race conditions affecting business logic
-
Exposing "hidden" passwords through client-side manipulation
-
Client manipulation or other techniques that lead to the use of premium features not otherwise enabled or allowed
-
DMARC, SPF, or other email server or DNS configuration settings and policies
-
Broken links
-
Recommendations or concerns over sweeping areas of the application’s architecture and/or design
Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 30 minutes ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Before we tracked it
Scope and reward changes recorded before this page started tracking it.
-
Scope removed
https://chrome.google.com/webstore/detail/bitwarden-free-password-m/nngceckbapebfimnlniiiahkandclblb?hl=en
-
Scope added
https://github.com/bitwarden/sdk-internal
-
Scope added
https://github.com/bitwarden/ios
-
Scope added
https://github.com/bitwarden/akd-watch (out of scope)
-
Scope added
https://github.com/bitwarden/autopush-manager (out of scope)
-
Scope added
https://github.com/bitwarden/bitwarden-russh (out of scope)
-
Scope added
https://github.com/bitwarden/phishing-test-page (out of scope)
-
Scope added
https://github.com/bitwarden/android
-
Scope added
https://github.com/bitwarden/rotation-daemon (out of scope)
-
Scope added
https://github.com/bitwarden/.github (out of scope)
-
Scope added
https://github.com/bitwarden/agent-access (out of scope)
-
Scope added
https://github.com/bitwarden/clients
-
Scope added
https://github.com/bitwarden/server
-
Scope added
https://github.com/bitwarden/passwordless-react-example (out of scope)
-
Rules updated
Added: “AI-Assisted Research”
-
Rules updated
Removed: “If you would like to encrypt your report, please use the PGP key with long ID `0xDE6887086F892325FEC04CC0D847525B6931381F` (available in the public keyserver po...”
-
Rules updated
Added: “Reports must be written in clear, human-comprehensible language with detailed, reproducible steps and an accompanying proof-of-concept. While we support the use...”
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2026-60104 | Bitwarden Server before 2026.6.0 does not verify that the email in a POST /auth-requests/admin-request body belongs to the authenticated caller, allowing a low-privileged organization member to obtain another user's vault key and a victim-scoped access token by creating a Trusted Device Encryption authentication request, bound to an attacker-controlled public key, that is readable from an unauthen | Critical 9.3 | 8 Jul 2026 |
| CVE-2026-57520 | Bitwarden Server before 2026.5.0 contains a privilege escalation vulnerability that allows authenticated Custom users with ManageUsers permission to remove Admin accounts from an organization by exploiting a missing role hierarchy check in the bulk user-remove endpoint. Attackers can supply Admin organization-user IDs in a bulk DELETE request to bypass the guard enforced on the single-user removal | High 7.1 | 25 Jun 2026 |
| CVE-2026-57521 | Bitwarden Server before 2026.5.0 contains a broken access control vulnerability that allows any authenticated user to access arbitrary organization billing data by supplying an arbitrary organizationId to the PreviewInvoiceController endpoints without membership or authorization checks. Attackers can exploit the missing ManageOrganizationBillingRequirement on the preview invoice endpoints to retri | Medium 5.3 | 25 Jun 2026 |
| CVE-2026-57522 | Bitwarden Server before 2026.5.0 contains a JSON injection vulnerability in IntegrationTemplateProcessor.ReplaceTokens(), which substitutes user-controlled values into event-integration templates without JSON encoding. When an organization has configured an event integration whose template references a user-controlled token (such as #ActingUserName# or #UserName#, populated from a member's display | Low 2.3 | 25 Jun 2026 |
| CVE-2026-43638 | Bitwarden Server prior to v2026.4.1 contains a missing authorization vulnerability that allows any authenticated user to write ciphers into an arbitrary organization via `POST /ciphers/import-organization` by submitting an empty `collections` array, which causes the server-side permission check to be skipped. | Medium 5.3 | 11 May 2026 |
| CVE-2026-43639 | Bitwarden Server prior to v2026.4.0 contains a missing authorization vulnerability that allows a provider service user to add an arbitrary organization to their provider via `POST /providers/{providerId}/clients/existing`, resulting in takeover of the target organization; self-hosted installations are unaffected as this endpoint is restricted to Cloud via SelfHosted(NotSelfHostedOnly = true). | High 8.9 | 11 May 2026 |
| CVE-2026-43640 | Bitwarden Server prior to v2026.4.1 does not require master-password re-authentication when retrieving or rotating an organization's SCIM API key, allowing an authenticated user with SCIM management privileges to obtain the key using only a valid session. | High 8.6 | 11 May 2026 |
| CVE-2026-42994 | Bitwarden CLI 2026.4.0 from 2026-04-22T21:57Z to 2026-04-22T23:30Z, when obtained from npm, had embedded malicious code. This is related to a Checkmarx supply chain incident. | High 8.8 | 1 May 2026 |
| CVE-2023-38840 | Bitwarden Desktop 2023.7.0 and below allows an attacker with local access to obtain sensitive information via the Bitwarden.exe process. | Medium 5.5 | 15 Aug 2023 |
| CVE-2023-27706 | Bitwarden Windows desktop application versions prior to v2023.4.0 store biometric keys in Windows Credential Manager, accessible to other local unprivileged processes. | High 7.1 | 9 Jun 2023 |
| CVE-2018-25081 | Bitwarden through 2023.2.1 offers password auto-fill within a cross-domain IFRAME element. NOTE: the vendor's position is that there have been important legitimate cross-domain configurations (e.g., an apple.com IFRAME element on the icloud.com website) and that "Auto-fill on page load" is not enabled by default. | High 7.5 | 9 Mar 2023 |
| CVE-2023-27974 | Bitwarden through 2023.2.1 offers password auto-fill when the second-level domain matches, e.g., a password stored for an example.com hosting provider when customer-website.example.com is visited. NOTE: the vendor's position is that "Auto-fill on page load" is not enabled by default. | High 7.5 | 9 Mar 2023 |
| CVE-2020-15879 | Bitwarden Server 1.35.1 allows SSRF because it does not consider certain IPv6 addresses (ones beginning with fc, fd, fe, or ff, and the :: address) and certain IPv4 addresses (0.0.0.0/8, 127.0.0.0/8, and 169.254.0.0/16). | High 7.5 | 21 Jul 2020 |
| CVE-2019-19766 | The Bitwarden server through 1.32.0 has a potentially unwanted KDF. | High 7.5 | 12 Dec 2019 |
Original policy
Copied from hackerone.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Bitwarden believes that working with security researchers across the globe is crucial to keeping our users safe. If you believe you've found a security issue in our product or service, we encourage you to notify us. We welcome working with you to resolve the issue promptly. Thanks in advance!
Response targets
Bitwarden will make a best effort to meet the following response targets for hackers participating in our program:
- Time to first response (from report submission): 3 business days
- Time to triage (from report submission): 5 business days
- Time to resolution (from triage): Varies by severity, anywhere from 1-90 business days
We'll keep you informed about our progress as appropriate throughout the process.
Disclosure policy
- Let us know as soon as possible upon discovery of a potential security issue, and we'll make every effort to quickly resolve the issue.
- Provide us a reasonable amount of time to resolve the issue before any disclosure to the public or a third-party. We may publicly disclose the issue before resolving it, if appropriate.
- Follow HackerOne's disclosure guidelines.
Program rules
- Reports must be written in clear, human-comprehensible language with detailed, reproducible steps and an accompanying proof-of-concept. While we support the use of AI/LLM tools for research, the report itself must be authored in a human-comprehensible manner. Reports that are not detailed enough to reproduce the issue will be closed and are not eligible for a bounty.
- Use the built-in CVSS 3.0 calculator for the severity of your reported finding; do not submit findings with general or undefined severity values.
- Submit one vulnerability per report, unless you need to chain vulnerabilities to provide impact.
- Social engineering (e.g. phishing, vishing, smishing) is prohibited.
- Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service. Only interact with accounts you own or with the explicit permission of the account holder.
AI-Assisted Research
- AI tools may be used to help find and document vulnerabilities, but the reporter remains fully accountable for what is submitted.
- Verify the finding against a running instance of the affected client or server before submitting. Static or AI-generated code analysis and plausible-sounding exploit narratives are not vulnerability reports.
- Check whether the preconditions assumed by the report already give an attacker what they're after, e.g. code execution on the device, an unlocked vault, a phished session, or a malicious browser extension already installed. Chained or precondition-heavy scenarios must still demonstrate real, additional impact.
- Do not rely on an AI tool's judgment about scope, severity, or exploitability. Verify any such claim against this policy and the live product before submitting.
- Include reproduction evidence (screen recording, screenshots, or logs) with the report. This is required for all submissions per the Program rules above, and is strongly encouraged as a full exploit-chain recording for AI-assisted reports specifically.
- Reports consisting of AI-generated vulnerability hypotheses without independent verification, a working reproduction, or demonstrated product impact will be closed as Not Applicable.
In-scope
Security issues in the current release of all Bitwarden products, including Bitwarden Password Manager, Bitwarden Secrets Manager, and Bitwarden Passwordless.dev. This encompasses all clients, including the web app, browser extension, mobile apps (iOS and Android), desktop app, CLI, and SDKs, as well as server-based code. Product downloads are available at https://bitwarden.com. Source code is available at https://github.com/bitwarden.
Out-of-scope
The following classes are out-of scope:
- Authorization state and session expiration on bearer tokens e.g. using a still-valid token after authorization changes elsewhere
- Bugs that are already reported on any of Bitwarden's issue trackers or that we already know of; note that some of our issue tracking is private
- Any Bitwarden project that is currently in a early/preview stage of development
- Issues in an upstream software dependency (e.g. ASP.NET) that are already reported to the upstream maintainer
- Attacks requiring physical access to a user's device
- Self-exploitation
- Bugs/Defects that do not cross a security boundary
- Username / email enumeration
- Issues related to software or protocols not under Bitwarden's control
- Vulnerabilities in outdated versions of Bitwarden
- Missing security best practices that do not directly lead to a vulnerability
- Missing HTTP security headers, e.g.
Strict-Transport-Security,X-Frame-Options,X-XSS-Protection,Content-Security-Policy, etc. - CSV injection
- Lack of
Secure/HTTPOnlyflags on non-sensitive cookies - Issues that do not have any impact on the general public
- Any activity that could lead to the disruption of our service (DoS)
- Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS
- Rate limiting or brute-force issues on non-authentication endpoints
- Issues that require unlikely user interaction
- Unencrypted authentication tokens
- KDF count disclosure on the
/preloginserver API - Race conditions affecting business logic
- Exposing "hidden" passwords through client-side manipulation
- Client manipulation or other techniques that lead to the use of premium features not otherwise enabled or allowed
- DMARC, SPF, or other email server or DNS configuration settings and policies
- Broken links
- Recommendations or concerns over sweeping areas of the application’s architecture and/or design
- Scenarios that are extremely complex, difficult, or unlikely when utilizing already compromised administrative accounts, self-hosted server, networks, or physical devices which would render much easier, and alternate means of compromising the data contained within Bitwarden
While researching, we'd like to ask you to refrain from:
- Denial of service
- Spamming
- Social engineering (including phishing) of Bitwarden staff or contractors
- Any physical attempts against Bitwarden property or data centers
A note on rate limiting
There are rate limiting controls present on the application, so be careful in running scanners or anything that might send an excessive number of requests and add additional wait times to your testing. * If you exceed the rate limit too often your IP will be banned. For this program we request that you submit flaw hypotheses for any enumeration vulnerabilities you believe you have found.
Test plan
- Please use your
@wearehackerone.comemail alias when signing up for an account. - For Enterprise access for testing, please create a test organization that is separate from any personal account, then contact us to upgrade.
We want to help you!
If you have something that you feel is close to exploitation, or if you'd like some information regarding the internal API, or generally have any questions regarding the app that would help in your efforts, please contact us and ask for that information. As stated above, Bitwarden wants to help you find issues, and is more than willing to help.
If you feel you have a history of quality reports under this program and should be invited to our private bounty program, please reach out.
Thank you for helping keep Bitwarden and our users safe!