dani-garcia Vaultwarden up to 1.35.x SSO Login Flow email_verified assertion

Summaryinfo

A vulnerability was found in dani-garcia Vaultwarden up to 1.35.x and classified as critical. Affected by this issue is some unknown functionality of the component SSO Login Flow. Such manipulation of the argument email_verified leads to assertion. This vulnerability is uniquely identified as CVE-2026-47164. The attack can be launched remotely. No exploit exists.

Detailsinfo

A vulnerability was found in dani-garcia Vaultwarden up to 1.35.x and classified as critical. Affected by this issue is an unknown code of the component SSO Login Flow. The manipulation of the argument email_verified with an unknown input leads to a assertion vulnerability. Using CWE to declare the problem leads to CWE-617. The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary. Impacted is confidentiality, integrity, and availability. CVE summarizes:

Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.36.0, Vaultwarden's SSO login flow checked the IdP email_verified claim only for new-user creation and not when SSO_SIGNUPS_MATCH_EMAIL=true linked an IdP identity to an existing local account, allowing an attacker-controlled IdP identity asserting a victim email address to bind to and authenticate as that account. This issue is fixed in version 1.36.0.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-47164 since 05/18/2026. The exploitation is known to be easy. The attack may be launched remotely. There are known technical details, but no exploit is available.

Upgrading to version 1.36.0 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• dani-garcia

Name

• Vaultwarden

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10
• 1.11
• 1.12
• 1.13
• 1.14
• 1.15
• 1.16
• 1.17
• 1.18
• 1.19
• 1.20
• 1.21
• 1.22
• 1.23
• 1.24
• 1.25
• 1.26
• 1.27
• 1.28
• 1.29
• 1.30
• 1.31
• 1.32
• 1.33
• 1.34
• 1.35

Website

• Product: https://github.com/dani-garcia/vaultwarden/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion