CVE-2026-60104 Details

A vulnerability in Bitwarden Server versions prior to 2026.6.0 allows low-privileged organization members to bypass authorization and access another user's vault key, leading to account takeover. This issue arises because the server does not verify that the email provided in a POST request to '/auth-requests/admin-request' belongs to the authenticated user. Exploitation involves creating a Trusted Device Encryption authentication request, using an attacker-controlled public key, which can be read from an unauthenticated endpoint once approved. The vulnerability allows the attacker to obtain the victim's vault key and a scoped access token, facilitating unauthorized access to the victim's account.

Users can update to Bitwarden Server version 2026.6.0 or later, where this vulnerability has been fixed.