{"affected":[{"defaultStatus":"unaffected","ecosystem":"github","packageName":"bitwarden/server","product":"bitwarden server","source":"CNA: VulnCheck","vendor":"bitwarden","versions":[{"lessThan":"2026.5.0","status":"affected","version":"2025.6.0","versionType":"custom"}]}],"cveId":"CVE-2026-101878","cwes":["CWE-303"],"description":"Bitwarden Server 2025.6.0 before 2026.5.0 declares the @ExternalId parameter of the User_ReadBySsoUserOrganizationIdExternalId stored procedure as NVARCHAR(50) while the column it queries stores NVARCHAR(300), silently truncating the SSO login identifier on SQL Server deployments and allowing a user whose identity-provider identifier begins with another organization member's full 50-character identifier to authenticate as that member and obtain a victim-scoped access token.","epss":{"date":"2026-11-08","percentile":0.17608,"score":0.00258},"exploits":[{"kind":"exploit","source":"CNA: VulnCheck","url":"https://sanjokkarki.com.np/blog/bitwarden-sso-externalid-truncation"}],"kev":null,"metrics":[{"score":7.7,"severity":"high","source":"CNA: VulnCheck","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0"},{"score":7.5,"severity":"high","source":"CNA: VulnCheck","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}],"modifiedAt":1794146442524,"publishedAt":1790647112484,"references":[{"source":"CNA: VulnCheck","tags":["technical-description","exploit"],"url":"https://sanjokkarki.com.np/blog/bitwarden-sso-externalid-truncation"},{"source":"CNA: VulnCheck","tags":["release-notes"],"url":"https://github.com/bitwarden/server/releases/tag/v2026.5.0"},{"source":"CNA: VulnCheck","tags":["issue-tracking","patch"],"url":"https://github.com/bitwarden/server/pull/7501"},{"source":"CNA: VulnCheck","tags":["patch"],"url":"https://github.com/bitwarden/server/commit/27ae3d5455f723975fac03819eaeba8710666bc4"},{"source":"CNA: VulnCheck","tags":["third-party-advisory"],"url":"https://www.vulncheck.com/advisories/bitwarden-server-authentication-bypass-via-sso-identifier-truncation"}],"remediation":[{"kind":"fix","source":"CNA: VulnCheck","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://github.com/bitwarden/server/pull/7501"},{"kind":"fix","source":"CNA: VulnCheck","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://github.com/bitwarden/server/commit/27ae3d5455f723975fac03819eaeba8710666bc4"}],"revision":"5b8b997bfe1e5361ff5a74781b3f284fda923c3d831a3688f0f93028d3fa96d1","sources":[{"modifiedAt":1794146442524,"name":"CNA: VulnCheck","retrievedAt":1794147004052,"url":"https://www.cve.org/CVERecord?id=CVE-2026-101878"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1794150618043,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101878"}],"ssvc":{"assessedAt":1790702505867,"automatable":"no","exploitation":"poc","source":"ADP: CISA-ADP","technicalImpact":"total"},"status":"published","title":"Bitwarden Server 2025.6.0 < 2025.6.0 Authentication Bypass via SSO Identifier Truncation","updatedAt":1794150618043}