Vaultwarden

Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability CVE history 15 Last 12 months 19 Lifetime Access control 40 % Auth bypass 35 % Parsing/validation 15 % Info disclosure 10 % Latest advisories Loading the feed Overview Vaultwarden is an independent Rust reimplementation of the Bitwarden server API, unaffiliated with Bitwarden Inc., and it is the default self-hosted password manager: one small Docker image running on home servers, NAS boxes, small-business infrastructure and a good deal of internal corporate estate. What it stores is credentials. CVE-2026-43912 is the reference point for what a bug here costs, a cross-organisation group binding that granted read and write access into another organisation's vault. Two maintainers hold all of it with no budget, and the upstream vendor's own HackerOne programme now pays nothing either, so sorona.xyz pays you directly on qualified, reproduced findings. In scope The policy accepts security issues in any current release of Vaultwarden, which it defines as the current latest release plus main and testing . Everything below is inside that, and nothing narrower is carved out The whole Bitwarden-compatible server API: the cipher, folder, sync and account endpoints every client talks to, whichever client is on the other end The organisation and collection model in full, covering group bindings, membership confirmation, invites, emergency access and the checks meant to keep one organisation's vault out of another's reach Authentication end to end, from password login and rate limiting through to the SSO flow, session issuance and refresh handling Two-factor handling across every method the server supports, including WebAuthn assertion processing and TOTP verification The admin panel, its authentication, and every setting an administrator can change on a running server Attachments and Sends, covering upload, storage, access control and expiry The icon-fetching endpoint and any other path where the server makes an outbound request on a user's behalf The WebSocket notification path that pushes vault changes to connected clients The CLI-facing and API-key endpoints that scripted consumers authenticate against Out of scope The web-vault and Bitwarden's mobile and desktop clients: the policy sends these to github.com/bitwarden , which Vaultwarden is explicitly not associated with Anything already reported, ruled out by name in the policy's exclusions list Upstream dependency vulnerabilities, unless Vaultwarden's own use of the dependency is what makes it reachable Attacks requiring physical access to the host Findings against an outdated release: the in-scope statement covers the current latest release plus main and testing only Denial of service, spamming and social engineering, ruled out by the policy's research conduct rules Most-valued findings Anything that crosses the organisation boundary, whether reading, writing or destroying another tenant's vault. This is the densest part of the 2026 record: CVE-2026-43912 granted cross-org read and write through a group binding, and CVE-2026-43913 let an unconfirmed owner purge an entire organisation vault Authentication bypass in the SSO path, identity binding above all. CVE-2026-47164 showed that attaching an attacker-controlled identity to an existing local account is a full takeover of a password vault, and CVE-2026-47158 put CSRF on the same authorisation request Two-factor defects, particularly WebAuthn or TOTP verification that acts on a credential before validating it, the shape CVE-2026-31835 took Brute-force and rate-limit bypass on login, the class CVE-2026-43914 landed in Server-side request forgery out of the icon endpoint or any other outbound fetch, as CVE-2026-47160 achieved with decimal, hexadecimal and octal IP encodings Anything that recovers vault items, attachments or the protected symmetric key without the master password, since the server is only ever supposed to hold ciphertext Privilege escalation inside an organisation, member to admin to owner, on a server that routinely holds several organisations' credentials at once Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. Report privately through one of the three channels the project publishes: GitHub private vulnerability reporting on dani-garcia/vaultwarden , the project Matrix room, or the security address published in SECURITY.md as an anti-scrape image Encrypt to the project GPG key, fingerprint 13BB3A34C9E380258CE43D595CB150B31F6426BC , listed on four public keyservers under [email protected] Only current code is in scope: the policy covers any current release, meaning the latest tag plus main and testing , so a finding against an outdated version is excluded Bugs in the web-vault or in Bitwarden's mobile and desktop clients belong to github.com/bitwarden , a project Vaultwarden states it is not associated with Already-reported bugs, upstream dependency issues and physical-access attacks are all excluded by name The research conduct rules are explicit and short: no denial of service, no spam, no social engineering Disclosure Coordinated privately with a two-person maintainer team over Matrix, the GPG-protected security address or GitHub private vulnerability reporting, and published as a GitHub Security Advisory alongside a patched release. The 2026 cadence shows the pipeline moving in batches, with three advisories on 25 April and three more on 19 May, so plan for an embargo that runs to the next security release rather than to a fixed number of days. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability