| Package | Affected versions | Patched versions |
|---|---|---|
| server | < 2026.4.1 | 2026.4.1 |
Bitwarden Server prior to v2026.4.1 does not require master-password re-authentication when retrieving or rotating an organization's SCIM API key, allowing an authenticated user with SCIM management privileges to obtain the key using only a valid session.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free