Back Linuxsecurity

Fedora 44 Vaultwarden Critical Security Fix from 2026

Linuxsecurity •LinuxSecurity Advisories • June 12, 2026

* Wed Jun 3 2026 Jonathan Wright - 1.36.0-1 - update to 1.36.0 rhbz#2368636 - Fix bitwarden mobile app not working rhbz#2437599 - Fix CVE-2025-58160 vaultwarden: Tracing log pollution - Fix CVE-2026-25537 vaultwarden: jsonwebtoken has Type Confusion that leads to potential authorization bypass - Fix CVE-2026-25727 vaultwarden: time affected by a stack exhaustion denial of service attack - Fix CVE-2026-26012 vaultwarden: Information disclosure due to bypassed collection permissions - Fix CVE-2026-27898 vaultwarden: Information disclosure via API partial update - Fix CVE-2026-27803 vaultwarden: Unauthorized collection management operations due to improper access control - Fix CVE-2026-27801 vaultwarden: Two-factor authentication bypass allows unauthorized access and data deletion

Fedora Update Notification FEDORA-2026-e14ea170b6 2026-06-12 00:58:37.608023+00:00 Name : vaultwarden Product : Fedora 44 Version : 1.36.0 Release : 1.fc44 URL : Summary : Unofficial Bitwarden compatible server Description : Unofficial Bitwarden compatible server.

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-e14ea170b6' at the command line. For more information, refer to the dnf documentation available at

Get the latest Linux and open source security news straight to your inbox.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Security Flaws in Vaultwarden Affecting Fedora 43 and 44 Multiple critical vulnerabilities have been identified in Vaultwarden, impacting Fedora 43 and 44. Key issues include CVE-2026-27801, allowing two-factor authentication bypass, and CVE-2026-27803, which enables unauthorized collection management operations. These vulnerabilities could lead to unauthorized access and data deletion. The updates released on June 3, 2026, address these flaws, along with several others, including CVE-2026-25537 and CVE-2026-26012, which involve authorization bypass and denial of service attacks. Users are urged to apply the updates promptly to mitigate risks. The vulnerabilities were disclosed between February and March 2026, with some having proof-of-concept (PoC) exploits available. The affected systems include Vaultwarden installations on Fedora platforms. 4 sources 73

Extracted Entities

Fedora 44 Vaultwarden Critical Security Fix from 2026

The full story

Extracted Entities

Attack Types (2)

CVEs (7)

CWE Weaknesses (4)

Platforms (1)