CVE-2026-47164 Details

A vulnerability in Vaultwarden's SSO login process prior to version 1.36.0 allowed an attacker to link an identity from an identity provider (IdP) to an existing Vaultwarden account without proper email verification. This flaw could be exploited by an attacker who controlled an IdP identity claiming the victim's email, enabling them to authenticate as the victim. The issue arose because the email verification check was only applied during new user registration, not when linking IdP identities to existing accounts. As a result, an attacker could bind their IdP identity to a victim's account and gain access, especially if the victim had no two-factor authentication enabled.

Users should update to Vaultwarden version 1.36.0 or later, where this vulnerability has been fixed. For those using an IdP that cannot reliably verify email ownership, it is recommended to disable the 'SSO_SIGNUPS_MATCH_EMAIL' feature.