CVE-2026-57522

LOW 3.5

Bitwarden Server < 2026.5.0 JSON Injection via Webhook Templates

CVSS Score

3.5

EPSS Score

0.0%

EPSS Percentile

0th

Bitwarden Server before 2026.5.0 contains a JSON injection vulnerability in IntegrationTemplateProcessor.ReplaceTokens(), which substitutes user-controlled values into event-integration templates without JSON encoding. When an organization has configured an event integration whose template references a user-controlled token (such as #ActingUserName# or #UserName#, populated from a member's display name), an authenticated member can set their display name to JSON metacharacters and inject arbitrary key-value pairs into the rendered payloads delivered to webhook, SIEM, Slack, Teams, or Datadog endpoints, making injected fields indistinguishable from legitimate template output.

CWE	CWE-74
Vendor	bitwarden
Product	server
Published	Jun 25, 2026

Stay Ahead of the Next One

Get instant alerts for bitwarden server

Be the first to know when new low vulnerabilities affecting bitwarden server are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

Low

Availability

None

Affected Versions

bitwarden / server

0 < 2026.5.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

sanjokkarki.com.np: https://sanjokkarki.com.np/blog/bitwarden-webhook-json-injection github.com: https://github.com/bitwarden/server/releases/tag/v2026.5.0 github.com: https://github.com/bitwarden/server/pull/7593 github.com: https://github.com/bitwarden/server/commit/a26afd18130ef985ede5c97d277820d045185a28 vulncheck.com: https://www.vulncheck.com/advisories/bitwarden-server-json-injection-via-webhook-templates

Credits

Sanjok Karki