Loading story…
Bitwarden Server versions before 2026.6.0 contain an authorization bypass in POST /auth-requests/admin-request tracked as CVE-2026-60104. The flaw stems from the server failing to verify that the email address supplied in the request body belongs to the authenticated caller, allowing a low-privileged organization member to initiate a Trusted Device Encryption authentication request on behalf of another user.
If the victim approves the request, an attacker can bind it to an attacker-controlled public key and then use an unauthenticated endpoint to obtain the victim's vault key and a victim-scoped access token, resulting in full account takeover. The issue is classified as CWE-639 and carries a CVSS v3.1 score vector of AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N; Bitwarden addressed the vulnerability in version 2026.6.0.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
CVE-2026-60104 was publicly listed as an authorization bypass affecting Bitwarden Server versions before 2026.6.0. The listing states the flaw stems from failure to verify that the email address in an admin auth request belongs to the authenticated caller and references the fixing release and related technical materials.
VulnCheck published an advisory describing an authorization flaw in Bitwarden Server before version 2026.6.0. The write-up says a low-privileged organization member could abuse POST /auth-requests/admin-request to obtain a victim's vault key and victim-scoped access token, leading to account takeover.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
threataft.com
Open sourcecvefeed.io
Open sourcegithub.com
Open sourcevulncheck.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
SmarterTools *SmarterMail* patched a critical authentication bypass tracked as **WT-2026-0001** after researchers reported that attackers can reset the **system administrator** password without authentication by abusing the `/api/v1/auth/force-reset-password` endpoint. The flaw stems from logic in `SmarterMail.Web.Api.AuthenticationController.ForceResetPassword` that permits anonymous access and trusts a user-supplied boolean (`IsSysAdmin`); when set to `true`, the code path updates an admin account’s password without validating the old password or enforcing authorization checks. Both reporting indicate the issue is **actively exploited in the wild**, with observed exploitation occurring **within days of the vendor patch** (including reports of activity as soon as two days after release). Once an attacker resets the admin password, they can take over the mail server and leverage built-in administrative capabilities to execute OS commands, effectively achieving **remote code execution (RCE)** and full compromise of affected SmarterMail deployments; the patch was released as **Build 9511** following responsible disclosure by watchTowr Labs researchers **Piotr Bazydlo** and **Sina Kheirkhah**.
Jun 29, 2026
**watchTowr Labs** disclosed **WT-2026-0001**, an **authentication bypass** in *SmarterTools SmarterMail* that allows a user to reset the **system administrator password** via a password-reset mechanism and then leverage SmarterMail’s built-in “RCE-as-a-feature” capabilities to execute OS commands. The researcher reported the issue and stated it was patched quickly, citing a fixed release on **SmarterMail release 9511 (2026-01-15)**; the publication was accelerated after a tip that attackers were actively exploiting the flaw to reset admin passwords, with forum-shared logs reportedly showing suspicious activity tied to the `force-reset-password` endpoint. **Resecurity** reported exploitation of **CVE-2026-22794** in *Appsmith*, a critical authentication weakness in the password reset flow where the application trusts a **client-controlled `Origin` header** to build reset links. An attacker can initiate a reset for a victim while supplying a malicious Origin so the victim’s email contains a link to attacker infrastructure; when clicked, the reset token is exposed, enabling password change and **full account takeover**. Resecurity identified the affected endpoint as `/api/v1/users/forgotPassword`, stated **Appsmith ≤ 1.92** is affected, and that the issue is fixed in **Appsmith ≥ 1.93**.
Jun 29, 2026
Bulwark Webmail, the self-hosted webmail client for **Stalwart Mail Server**, patched two high-severity vulnerabilities in version **1.4.10**. **CVE-2026-34833** exposed users' plaintext passwords because the `GET /api/auth/session` endpoint returned the password in a JSON response, creating a risk of credential leakage through browser logs, local caches, and network proxies. The issue was classified as **CWE-312** and carries a high confidentiality impact. A second flaw, **CVE-2026-34834**, allowed authentication bypass in the `verifyIdentity()` function because missing session cookies were not properly validated. In affected versions before **1.4.10**, an unauthenticated attacker could send arbitrary headers and gain access to or modify user settings through the ` /api/settings ` endpoint. The vulnerability was classified as **CWE-287**, and GitHub security advisories published references to both the advisory and the patch release.
Jun 29, 2026