SSO authentication bypass through identifier truncation in Bitwarden Server

Bitwarden Server 2025.6.0 before 2026.5.0 declares the @ExternalId parameter of the User_ReadBySsoUserOrganizationIdExternalId stored procedure as NVARCHAR(50) while the column it queries stores NVARCHAR(300), silently truncating the SSO login identifier on SQL Server deployments and allowing a user whose identity-provider identifier begins with another organization member's full 50-character identifier to authenticate as that member and obtain a victim-scoped access token.

• Bitwarden Server: versions >= 2025.6.0, < 2026.5.0 are marked affected.
• Deployment scope: the flaw is in the SSO lookup path that uses the stored procedure on SQL Server. The supplied record does not confirm the same flaw in other database access paths.
• Fixed release: Bitwarden Server 2026.5.0 is identified as containing the fix. This does not by itself verify every later or parallel release branch, which should be checked separately.

Bitwarden Server uses the User_ReadBySsoUserOrganizationIdExternalId stored procedure for SSO user lookups on the SQL Server path. The procedure declares @ExternalId as NVARCHAR(50), while the SsoUser.ExternalId column stores values as NVARCHAR(300). SQL Server silently coerces an input longer than 50 characters to its first 50 characters before performing the equality comparison, rather than rejecting the request. If an attacker can use or influence an identity-provider identifier whose first 50 characters exactly match another member's identifier, the lookup can return the victim's user record. The SSO flow can then issue an access token carrying the victim's identity. Exploitation requires access to the SSO login flow and an identifier with the required prefix, so the condition does not apply equally to every SSO account. The available evidence establishes the SQL Server data path as affected, but does not establish the same behavior for other database paths.

The flaw is reachable over the network through the SSO login flow. The supplied assessment describes low required privileges, no separate victim interaction, and high attack complexity. The attacker still needs to authenticate through, or influence, the identity provider and satisfy the identifier-prefix condition. Public technical exploit material and proof-of-concept evidence are available. The record does not establish exploitation in the wild or identify a specific campaign.

The primary technical result is authentication as another organization member and issuance of an access token carrying that member's user identity. This may extend the attacker's access to functions, data, or actions authorized for the victim's token. The confidentiality, integrity, and availability consequences depend on the victim's privileges and the endpoints reachable with the token. The flaw does not automatically defeat every client-side encryption layer, and the available evidence does not confirm vault decryption. Organization scoping remains part of the lookup, so the described impact is centered on member impersonation within an affected organization.

An attacker may authenticate to an organization as another member instead of as the attacker's own account. A victim-scoped access token may expose functions and data available to that member, creating risk to organizational data, settings, and administrative actions. The practical severity depends on the impersonated member's permissions and the organization's encryption configuration. The evidence confirms issuance of a token carrying the victim identity, but does not demonstrate a specific vault-decryption or data-theft scenario.

1. Upgrade Bitwarden Server to exactly 2026.5.0, the release identified as containing the fix.
2. Confirm that the database migrations completed successfully on each SQL Server deployment. The fix includes an updated stored procedure and the migration util/Migrator/DbScripts/2026-04-23_00_UpdateReadBySsoUserOrganizationIdExternalI.sql.
3. After the upgrade, inspect User_ReadBySsoUserOrganizationIdExternalId and verify that @ExternalId is declared as NVARCHAR(300) in the live database.
4. If the upgrade cannot be performed, treat affected SQL Server SSO deployments as exposed and obtain direct mitigation guidance from Bitwarden. The supplied record does not provide a validated workaround.

• Inventory all Bitwarden Server versions and identify systems in the >= 2025.6.0, < 2026.5.0 range.
• Identify deployments with SSO enabled and SQL Server as the database, because this is the affected data path established by the evidence.
• Inspect the SQL Server definition of User_ReadBySsoUserOrganizationIdExternalId. The @ExternalId parameter should be declared as NVARCHAR(300) in a remediated deployment.
• Review SSO configurations and identity-provider identifiers that can exceed 50 characters or can be influenced by a user. This checks an exposure condition, not a confirmed compromise indicator.
• Compare IdP identities with the account associated with issued access tokens and review unusual profile access or member actions. This is precautionary monitoring, not a known IOC. The absence of suspicious log evidence does not prove that the deployment is safe.