CVE-2026-47164 dani-garcia CVE debrief

Who should care

Defenders managing Vaultwarden deployments, especially those using SSO_SIGNUPS_MATCH_EMAIL=true, should assess exposure and verify configurations. This includes reviewing current configurations, ensuring version 1.36.0 or later is used, and monitoring for potential authentication anomalies. Additionally, defenders should consider the potential operational impacts, such as authentication bypass and lateral movement, and take appropriate measures to mitigate

Why it matters

Defenders should prioritize verifying Vaultwarden configurations, especially those using SSO_SIGNUPS_MATCH_EMAIL=true, and ensure they are using version 1.36.0 or later to prevent potential authentication bypass and lateral movement.

• Potential authentication bypass for accounts with SSO_SIGNUPS_MATCH_EMAIL=true
• Possible lateral movement within Vaultwarden deployments
• Need for verification of Vaultwarden version and configuration
• Potential impact on sensitive data access and management

Technical summary

Vaultwarden, a Bitwarden-compatible server written in Rust, did not properly verify the IdP email_verified claim when linking an IdP identity to an existing local account with SSO_SIGNUPS_MATCH_EMAIL=true. This allowed an attacker-controlled IdP identity asserting a victim email address to bind to and authenticate as that account. The issue is addressed in version 1.36.0 by properly verifying the email_verified claim, preventing potential authentication bypass and lateral movement within Vaultwarden deployments. Defenders should prioritize verifying Vaultwarden configurations and ensure they are using version 1.36.0 or later.

Defensive priority

Defenders should prioritize verifying Vaultwarden configurations, especially those using SSO_SIGNUPS_MATCH_EMAIL=true, and ensure they are using version 1.36.0 or later.

Recommended defensive actions

• Verify Vaultwarden configurations, especially those using SSO_SIGNUPS_MATCH_EMAIL=true
• Ensure Vaultwarden version 1.36.0 or later is used
• Monitor for potential authentication anomalies
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability and its fix. However, additional information about potential exploitation or affected deployments is limited. Defenders should verify Vaultwarden configurations, especially those using SSO_SIGNUPS_MATCH_EMAIL=true, and ensure they are using version 1.36.0 or later to prevent potential authentication bypass and lateral movement. Limited source information is available, so defenders must focus on verifying configurations and updating to the latest version.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.