CVE-2026-47159 Information disclosure in vaultwarden
Attackers can enumerate SSO-enabled organizations and obtain pre-validation tokens via SSO discovery, exposing sensitive metadata and enabling authentication workflow abuse.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-47159?
CVE-2026-47159 is a medium-severity vulnerability in dani-garcia vaultwarden, published on 15 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.36.0, Vaultwarden's SSO discovery and pre-validation flow returned organization-related SSO metadata including organizationIdentifier values for arbitrary email addresses and allowed a valid pre-validation JWT to be obtained with only the discovered identifier, enabling SSO-enabled organization enumeration and authentication workflow abuse. This issue is fixed in version 1.36.0.
Weakness: CWE-287
Which versions are affected by CVE-2026-47159?
How do I fix CVE-2026-47159?
No fix has been published for CVE-2026-47159 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-47159 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-47159 exists.
Sources
Also known as GHSA-hxqh-ff5p-wfr3.