CVE-2026-101878

Cve • September 29, 2026

Bitwarden Server 2025.6.0 before 2026.5.0 declares the @ExternalId parameter of the User_ReadBySsoUserOrganizationIdExternalId stored procedure as NVARCHAR(50) while the column it queries stores NVARCHAR(300), silently truncating the SSO login identifier on SQL Server deployments and allowing a user whose identity-provider identifier begins with another organization member's full 50-character identifier to authenticate as that member and obtain a victim-scoped access token.

CWE-303 : Incorrect Implementation of Authentication Algorithm

Default Status: unaffected

sanjokkarki.com.np: Researcher Blog external site technical-description exploit

github.com: Release Notes external site release-notes

github.com: Pull Request external site issue-tracking

github.com: Patch Commit external site patch

external site third-party-advisory

Authorized Data Publishers

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Bitwarden SSO Identifier Truncation Vulnerability (CVE-2026-101878) A vulnerability in Bitwarden Server versions 2025.6.0 to 2026.5.0 allows attackers to exploit an SSO identifier truncation issue. The stored procedure @ExternalId was defined as NVARCHAR(50) while the corresponding database column was NVARCHAR(300), leading to silent truncation of identifiers. This allows an attacker with a crafted identity-provider identifier that matches the beginning of a victim's identifier to authenticate as that victim and gain access to their vault. The vulnerability was reported on HackerOne and has been assigned CVE-2026-101878. The risk is considered high, especially for organizations using SQL Server with SSO. A patch was released on May 29, 2026, and users are urged to upgrade to version 2026.5.0 or later. Current exploitation status remains unclear, with no confirmed active exploitation reported. 4 sources 63

Extracted Entities

CVE-2026-101878

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

Domains (1)

MITRE ATT&CK (1)

Tools (1)

Vulnerabilities (1)