Is Vaultwarden 1.35.1 affected?

Dec 30, 2025 · Release notes ↗

CVSS 8.7

18 known vulnerabilities affect 1.35.1 (highest CVSS 8.7).

13 newer releases in its track, up to 1.37.4. What changed up to 1.37.4

Vulnerabilities affecting 1.35.1

8.7
CVE-2026-43912 Cross-Org Group Binding Enables Unauthorized Read And Write Access Into Another Organization
8.3
CVE-2026-47158 CSRF in SSO Authorization Flow fixed in 1.35.8
8.1
CVE-2026-43913 Unconfirmed Owner Can Purge Entire Organization Vault
7.7
CVE-2026-47164 SSO Email Auto-Link Can Bind an Existing Local Account to an Attacker-Controlled IdP Identity
7.3
CVE-2026-43914 Brute-force protection bypass vulnerability fixed in 1.35.4
6.8
CVE-2026-43911 Refresh tokens not invalidated on security stamp rotation
6.5
CVE-2026-26012 Full Cipher Enumeration Ignoring Organization Collection Permissions
5.9
GHSA-xwf8-pjh7-h589 Cross-organization full cipher access via unguarded full-access-group query
5.8
GHSA-hw4g-2v3f-74x5 Icon endpoint SSRF fix bypass via second-stage favicon IP literal URLs
5.8
CVE-2026-47160 Server-side request forgery (SSRF) via Icon Endpoint Decimal/Hex/Octal IP Bypass fixed in 1.35.8
5.5
GHSA-88qc-6ch9-mc3j Directory-connector member import (ldap_import) skips org-policy enforcement (check_user_allowed), bypassing the Single-Organization and required-2FA policies
5.3
GHSA-rxhg-2pw9-vf25 Send max_access_count can be exceeded by concurrent access requests
5.3
GHSA-96f7-78q5-j345 Unauthenticated WebSocket connection flooding on /notifications/anonymous-hub (resource-exhaustion DoS)
4.3
GHSA-455c-vgg9-jxw8 Failed cipher share leaves a cross-organization collection link that grants access to the cipher fixed in 1.37.0
4.3
GHSA-rqf8-2568-r7mc Manager-with-no-collections can enumerate org user/group → collection mappings (incomplete fix of GHSA-jjxg-p3v6-52ww)
4.3
CVE-2026-31835 Vaultwarden: WebAuthn assertion processed before signature verification allows persistent credential backup-flag tampering
4.0
GHSA-vh5m-fc9v-m84g SSRF filter bypass (regex not applied post-resolution)
medium
CVE-2026-47159 Authentication Flow Information Disclosure in SSO Discovery Allows Organization Enumeration and Pre-Validation Token Exposure fixed in 1.35.8

Newer releases

1.37.4	Oct 5, 2026	1.35.1 → 1.37.4
1.37.3	Sep 13, 2026	1.35.1 → 1.37.3
1.37.2	Aug 22, 2026	1.35.1 → 1.37.2
1.37.1	Jul 29, 2026	1.35.1 → 1.37.1
1.37.0	Jul 24, 2026	1.35.1 → 1.37.0
1.36.0	May 3, 2026	1.35.1 → 1.36.0
1.35.8	Apr 25, 2026	1.35.1 → 1.35.8
1.35.7	Apr 13, 2026	1.35.1 → 1.35.7
1.35.6	Apr 12, 2026	1.35.1 → 1.35.6
1.35.5	Apr 12, 2026	1.35.1 → 1.35.5
1.35.4	Feb 23, 2026	1.35.1 → 1.35.4
1.35.3	Feb 10, 2026	1.35.1 → 1.35.3
1.35.2	Jan 9, 2026	1.35.1 → 1.35.2