CVE-2024-39926 Cross-site scripting in n/a
Authenticated attackers can inject malicious scripts into the Vaultwarden admin dashboard, potentially compromising administrator sessions despite CSP mitigations.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2024-39926?
CVE-2024-39926 is a medium-severity cross-site scripting vulnerability in n/a, published on 13 Sep 2024. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
An issue was discovered in Vaultwarden (formerly Bitwarden_RS) 1.30.3. A stored cross-site scripting (XSS) or, due to the default CSP, HTML injection vulnerability has been discovered in the admin dashboard. This potentially allows an authenticated attacker to inject malicious code into the dashboard, which is then executed or rendered in the context of an administrator's browser when viewing the injected content. However, it is important to note that the default Content Security Policy (CSP) of the application blocks most exploitation paths, significantly mitigating the potential impact.
Weakness: CWE-79
Which versions are affected by CVE-2024-39926?
It affects 1 product.
Products include Dani-Garcia Vaultwarden.
How do I fix CVE-2024-39926?
No fix has been published for CVE-2024-39926 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2024-39926 being exploited?
There is no known exploitation of CVE-2024-39926 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2024-55225 Vaultwarden vulnerable to user impersonation
- CVE-2024-55224 Vaultwarden HTML injection vulnerability
- CVE-2024-39924 Privilege escalation in n/a
- CVE-2026-43912 Vaultwarden: Cross-Org Group Binding Enables Unauthorized Read And Write Access Into Another Organization
- CVE-2026-27802 Vaultwarden: Privilege Escalation via Bulk Permission Update to Unauthorized Collections by Manager
Sources
Also known as GHSA-vfwm-h968-g65h.