CVE-2026-47158 dani-garcia CVE debrief

Who should care

Defenders responsible for Vaultwarden deployments, especially those with SSO integration, should assess exposure and verify the need for updates or patches to prevent potential session hijacking.

Why it matters

The vulnerability in Vaultwarden's SSO authorization flow allows unauthenticated attackers to induce IdP authentication and redeem tokens for a fully authenticated session, emphasizing the need for defenders to verify exposure and assess update or patch requirements.

• Potential for unauthenticated attackers to hijack user sessions
• Need for defenders to verify exposure and assess update or patch requirements
• Importance of monitoring for suspicious authentication activity
• Limited information on potential exploitation or affected deployments

Technical summary

The SSO authorization flow in Vaultwarden prior to version 1.36.0 did not properly bind the OAuth state parameter, allowed attacker-controlled PKCE parameters, and did not remove SsoAuth records after failed token exchange. This enabled an unauthenticated attacker to induce IdP authentication and redeem tokens for a fully authenticated session. The vulnerability was caused by a flawed SSO authorization flow, which allowed an attacker to manipulate the OAuth state parameter and PKCE parameters. The vulnerability was fixed in version 1.36.0.

Defensive priority

Defenders should prioritize verifying exposure and assessing the need for updates or patches to Vaultwarden instances, especially those with SSO integration, to prevent potential session hijacking.

Recommended defensive actions

• Verify Vaultwarden instance version and update to 1.36.0 or later if necessary
• Assess SSO integration configurations for potential exposure
• Monitor for suspicious authentication activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, its impact, and the fixed version. However, additional information on potential exploitation or affected deployments is limited. The vulnerability was reported by a researcher and fixed by the vendor. The CVE record was published on 2026-07-15T16:16:46.200Z and has not been modified since then. The NVD entry provides additional information on the vulnerability, including its CVSS score and severity. Defenders should verify exposure and assess the need for updates or

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.