Bug 2476363 (CVE-2026-43911) - CVE-2026-43911 vaultwarden: Vaultwarden: Session persistence due to unexpired refresh tokens after security actions
Summary: CVE-2026-43911 vaultwarden: Vaultwarden: Session persistence due to unexpired...
Keywords:
Status: NEW
Alias: CVE-2026-43911
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2476443 2476444
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-05-11 23:09 UTC by OSIDB Bzimport
Modified: 2026-05-12 12:34 UTC (History)
0 users

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-05-11 23:09:13 UTC 
Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.35.5, refresh tokens are not invalidated when the user's security_stamp is rotated by some security-sensitive operations (password change, KDF change, key rotation, email change, org admin password reset, emergency access takeover). This allows an attacker holding a previously obtained refresh token to maintain session access even after the user has taken action to secure their account. This vulnerability is fixed in 1.35.5.
Note You need to log in before you can comment on or make changes to this bug.