CVE-2026-101878

Executive Summary

CVE-2026-101878 is an authentication logic flaw in self-hosted Bitwarden Server deployments where the @ExternalId parameter of the User_ReadBySsoUserOrganizationIdExternalId stored procedure is declared as NVARCHAR(50) while the underlying queried column stores NVARCHAR(300). This type-length mismatch silently truncates the single sign-on (SSO) login identifier on SQL Server deployments, allowing an attacker whose identity-provider identifier shares a 50-character prefix with a legitimate organization member's full identifier to authenticate as that member and obtain a victim-scoped access token. Versions 2025.6.0 through 2026.5.0 are affected; the flaw scores CVSS 7.5 (High) and is currently unpatched with no public PoC available.

Technical Analysis

The vulnerability is rooted in a stored-procedure parameter declaration that does not match the width of the column it filters against. The stored procedure User_ReadBySsoUserOrganizationIdExternalId is responsible for looking up a user within an organization by combining an organization identifier and an SSO external identifier. The @ExternalId parameter is declared as NVARCHAR(50), but the column it queries stores NVARCHAR(300). On Microsoft SQL Server, an implicit conversion when comparing an NVARCHAR(50) value against an NVARCHAR(300) column causes the shorter operand to be truncated to 50 characters. The query therefore matches on only the first 50 characters of the identifier rather than the full 300-character value.

This constitutes a silent truncation of the SSO login identifier during the authentication lookup. Because the match is performed on a prefix rather than the complete identifier, the stored procedure returns a user record belonging to the first organization member whose full identifier begins with those 50 characters. The attacker never needs to know or produce the victim's complete 300-character identifier — matching the 50-character prefix is sufficient.

The attack surface is the SSO authentication flow of Bitwarden Server, specifically the code path that resolves an IdP-provided external identifier to a local user account within an organization. The flaw class is CWE-303 (Incorrect Implementation of Authentication Algorithm): the authentication decision is made on a truncated, non-unique value, so the authentication function accepts inputs it should reject. On SQL Server, the attacker-controlled value is a valid, format-conforming SSO identifier. Exploitation requires only that the attacking user's IdP identifier be a string that begins with the victim's exact 50-character (or longer) identifier prefix.

Two preconditions follow directly from the description: (1) the deployment must use SQL Server (the truncation behavior is a SQL Server implicit-conversion property — the description explicitly limits impact to "SQL Server deployments"), and (2) the attacker must be able to supply an identifier beginning with the victim's 50-character prefix. That may be achievable through an attacker-controlled IdP, an IdP that permits user-controlled claim values, multiple identity providers, or a trusted-IdP misconfiguration that allows an attacker to set their own external identifier. The description does not detail how the identifier becomes attacker-controlled, so that step is configuration-dependent and not asserted here.

No public PoC, exploit code, or Nuclei template exists for this CVE; the mechanics below are derived strictly from the NVD description and the CWE-303 class.

Exploitation Scenarios

No public PoC is available; the attack chain is inferred from the vulnerability class and the NVD description.

1. Reconnaissance / target identification. The attacker identifies a Bitwarden Server deployment running an affected version (2025.6.0 through 2026.5.0) that is configured for SSO login against an organization using a SQL Server backend. The attacker must also be a member of (or able to authenticate to) the organization's SSO flow — this is consistent with the CVSS vector's PR:L (Low privileges), indicating the attacker needs a low-privileged or regular authenticated position. The attacker identifies a target victim's SSO external identifier, or its length and structure, such that its first 50 characters can be determined.

2. Triggering the flaw. The attacker initiates SSO authentication and supplies (directly or via a controllable identity provider) an external identifier whose first 50 characters are byte-for-byte identical to the first 50 characters of the victim's stored NVARCHAR(300) identifier. Because the stored procedure parameter is NVARCHAR(50), the lookup truncates the submitted value to 50 characters and matches against the truncated prefix of the victim's column value, returning the victim's user record instead of the attacker's.

3. Authentication / execution. The SSO flow accepts the returned victim user record and issues an access token scoped to that victim user. No credential theft, password brute force, or direct database access is required — the flaw is a logic error in the account-resolution step. The CVSS subscore I:H (High integrity impact) reflects that the authentication decision itself is corrupted; C:H (High confidentiality impact) reflects that the resulting token is victim-scoped.

4. Post-exploitation impact. The attacker holds a valid access token issued to the victim's identity within the organization. Depending on the victim's role, this can expose the victim's vault data, organization secrets, or administrative functions reachable with that token. The A:H subscore indicates High impact to availability, meaning the attacker's access could extend to destructive or disruptive actions available to the victim account. Because the token is legitimately issued, normal authentication logging may record it as a successful SSO login for the victim rather than an obvious intrusion.

Impact Assessment

CVSS 3.1 base score 7.5 (High), vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H:

• AV:N (Network) — exploitable over the network via the SSO authentication endpoint; no local access required.
• AC:H (High) — exploitation requires conditions that the attacker cannot fully control: a SQL Server-backed deployment AND the ability to present an identifier sharing a 50-character prefix with the victim's identifier. This complexity is why the vector carries AC:H despite arbitrary account impersonation.
• PR:L (Low) — the attacker requires a low-privileged authenticated position within the SSO flow / organization, not administrative rights.
• UI:N (None) — no user interaction on the victim's part is required.
• S:U (Unchanged) — impact is scoped to the vulnerable Bitwarden Server component.
• C:H / I:H / A:H — High confidentiality, integrity, and availability impact, driven by the attacker obtaining a victim-scoped access token and the ability to act fully as that user.

Blast radius. Any self-hosted Bitwarden Server using a SQL Server backend and SSO login where identifiers can be attacker-influenced. In multi-tenant or large-organization deployments, a single truncation collision enables cross-account impersonation, undermining the trust boundary that SSO is meant to enforce. Because a token is obtained rather than a password, downstream federation, audit trails, and vault access all see a "legitimate" session.

Business impact. Vault contents are the highest-value asset exposed: password credentials, API keys, secure notes, and organization-wide secrets. An attacker authenticated as a high-privilege organization member could pivot into the systems those credentials protect, producing a supply-chain-style downstream compromise. The integrity impact also means attacker actions are attributable to the victim, complicating incident response.

Exploitation status. No public exploit, PoC, or Nuclei template is known; CISA KEV does not list this CVE; EPSS is not yet scored by FIRST.org. Exploitation requires non-trivial preconditions (AC:H), but the technical barrier once preconditions are met is low.

Detection Guidance

Detection focuses on the observable consequences of the flaw: SSO authentications issuing tokens to users whose external identifiers are unusually long or prefix-collide, and stored-procedure invocations with truncated/oversized @ExternalId values. Because the resulting token is legitimately issued, detection depends on correlation and anomaly signals rather than a single malicious request signature.

Sigma Rule

title: Bitwarden SSO ExternalId Truncation Authentication Anomaly (CVE-2026-101878)
id: 3f9c2b7e-8a41-4d1e-9b6a-1c5d7f2e8a90
status: experimental
description: Detects Bitwarden Server SSO logins where the external identifier length or prefix-collision pattern is consistent with the NVARCHAR(50)/NVARCHAR(300) truncation flaw in User_ReadBySsoUserOrganizationIdExternalId.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-101878
author: valtersit.com
date: 2026/06/01
logsource:
  product: bitwarden
  service: identity
detection:
  selection_event:
    event.action|contains:
      - 'sso_login'
      - 'SsoUserOrganization'
      - 'User_ReadBySsoUserOrganizationIdExternalId'
  selection_anomaly:
    external_id_length: 50
  selection_collision:
    external_id_prefix_collision: true
  condition: selection_event and (selection_anomaly or selection_collision)
falsepositives:
  - Legitimate identifiers that are exactly 50 characters
  - Beneficial namespacing where prefixes are intentionally shared
level: high
tags:
  - attack.t1078
  - cve.2026-101878

YARA Rule

rule CVE_2026_101878_Bitwarden_ExternalId_Truncation
{
    meta:
        description = "Detects Bitwarden Server artifacts referencing the User_ReadBySsoUserOrganizationIdExternalId procedure with a truncated NVARCHAR(50) @ExternalId parameter, consistent with CVE-2026-101878."
        author = "valtersit.com"
        date = "2026-06-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-101878"
        cve = "CVE-2026-101878"

    strings:
        $proc = "User_ReadBySsoUserOrganizationIdExternalId" ascii wide nocase
        $param = "@ExternalId" ascii wide nocase
        $t50 = "NVARCHAR(50)" ascii wide nocase
        $t300 = "NVARCHAR(300)" ascii wide nocase

    condition:
        uint16(0) == 0x5A4D or filesize > 0
        and $proc
        and $param
        and ( $t50 or $t300 )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-101878 Bitwarden SSO ExternalId Truncation Attempt"; flow:to_server,established; http.method; content:"POST"; http.uri; content:"/identity/connect/token"; http.header; content:"Content-Type|3a| application/x-www-form-urlencoded"; pcre:"/(?:^|&)(?:ExternalId|external_id|login_hint)=[^&]{40,}/Ri"; threshold:type both, track by_src, count 5, seconds 60; classtype:attempted-user; reference:cve,2026-101878; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-101878; sid:2026101878; rev:1;)

Elastic Detection

sequence by user.name, source.ip with maxspan=10m
  [authentication where event.dataset == "bitwarden.identity" and event.action == "sso_login_attempt"]
  [authentication where event.dataset == "bitwarden.identity" and event.outcome == "success"
     and event.action == "sso_login_success"
     and bitwarden.sso.external_id_length >= 50]

Splunk SPL Query

index=bitwarden sourcetype="bitwarden:identity" event.action="sso_login_success"
| eval extid=coalesce(external_id, sso_external_id, user_external_id)
| eval extid_len=len(extid)
| where extid_len >= 50
| stats count, values(extid) as external_ids, values(src_ip) as src_ips, min(_time) as first_seen, max(_time) as last_seen by user, org_id
| where count >= 1
| table user, org_id, extid_len, external_ids, src_ips, first_seen, last_seen
| sort - last_seen

Wazuh OSSEC Rule

<group name="bitwarden,cve-2026-101878,">
  <rule id="101878" level="12">
    <decoded_as>json</decoded_as>
    <field name="event.action">sso_login_success</field>
    <regex field="bitwarden.sso.external_id">^.{50}$</regex>
    <description>CVE-2026-101878: Bitwarden SSO login succeeding with a 50-character external identifier (possible NVARCHAR truncation collision)</description>
    <mitre>
      <id>T1078</id>
    </mitre>
    <group>authentication_success,</group>
  </rule>
  <rule id="101879" level="10">
    <decoded_as>json</decoded_as>
    <field name="event.action">sso_login_success</field>
    <regex field="bitwarden.sso.external_id">^.{50}.+$</regex>
    <description>CVE-2026-101878: Bitwarden SSO success with external identifier longer than 50 characters that may be truncated for lookup</description>
    <mitre>
      <id>T1078</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix or workaround has been published as of this writing.

1. Immediate mitigations

• Audit SQL Server-backed Bitwarden Server deployments running versions 2025.6.0 through 2026.5.0 and identify any SSO external identifiers that are ≥50 characters or that share a 50-character prefix with another organization member. Prefix collisions are the exploitable condition.
• Where possible, enforce uniqueness and a maximum length below 50 characters on SSO external identifiers at the identity provider so that no two members share a 50-character prefix and no identifier overflows the NVARCHAR(50) parameter boundary used by the stored procedure.
• Restrict who can supply or modify SSO external identifiers. If the identity provider allows self-asserted identifiers, close that path or require an administrator to approve identifier values.
• Until patched, monitor SSO logins closely (see Detection Guidance) and treat any successful SSO login whose identifier length is exactly 50 characters as suspicious.
• If the stored procedure can be safely altered, widen the @ExternalId parameter to NVARCHAR(300) to match the underlying column — but only as a verified, tested change during a maintenance window, and record it as a compensating control, not a vendor patch.

2. Patch / upgrade steps

• Apply the vendor fix as soon as Bitwarden publishes a corrected release. The NVD description identifies "before 2026.5.0" as the affected range; upgrade to the fixed version (or the vendor-designated patched build) once available.
• After upgrading, re-audit stored-procedure definitions to confirm @ExternalId is declared as NVARCHAR(300) (or wider) and matches the column it queries.
• Re-run identifier uniqueness checks post-upgrade to confirm no residual collisions remain.

3. Long-term hardening

• Adopt standard invariants: parameter data types in stored procedures must match the columns they filter, and authentication lookups must compare full-length identifiers (or use normalized, collision-resistant keys).
• Include SQL Server deployments in your daily vendor advisories and run a routine check for column/parameter length mismatches in authentication paths.
• Enforce least-privilege and unique identifier assignment for IdP-managed accounts, and treat SSO external identifiers as security-sensitive attributes subject to change control.
• Add regression tests around authentication lookup uniqueness as part of the CI/CD pipeline for self-hosted deployments.

References

• NVD — CVE-2026-101878: https://nvd.nist.gov/vuln/detail/CVE-2026-101878
• CWE-303 — Incorrect Implementation of Authentication Algorithm: https://cwe.mitre.org/data/definitions/303.html
• Bitwarden Server releases and security advisories: https://github.com/bitwarden/server/releases
• Bitwarden security disclosures: https://bitwarden.com/help/security-changelog/
• CISA Known Exploited Vulnerabilities catalog (CVE not listed at time of writing): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public exploit code, PoC, Nuclei template, or known threat-actor campaign was identified for CVE-2026-101878. CISA KEV does not currently list this CVE, and EPSS has not yet been scored by FIRST.org.