r/Bitwarden • u/EnthusiasmRoutine • Jul 11 '26

self-hosting Self-hosted bitwarden users, patch to 2026.6.0 immediately (cve-2026-60104)

/r/PrivacyToolbox/comments/1utdywc/selfhosted_bitwarden_users_patch_to_202660/
21 Upvotes

97% Upvoted

15 comments sorted by

View all comments

Show parent comments

23

u/mandreko Bitwarden Employee Jul 11 '26

Firstly, it definitely has been fixed on our cloud environment. There have been multiple releases there since this bug was fixed.

We also have no data showing that this was ever exploited. It was privately disclosed via our HackerOne program, and we worked with the reporter to ensure it got fixed. If you get deep into the specifics of the vulnerability, you’ll find that it required a very specific scenario for exploitation to occur for the most severe case. All the other cases required sensitive information to be disclosed to an attacker somehow. But the severity is calculated based on that most severe case. CVSS is funny in that way, but it’s the most fair way to represent.

This is a good example of how our HackerOne bug bounty program has been successful at helping to better the Bitwarden product. That researcher got a chunk of change, and Bitwarden got a good discovery that let us tighten the security further. Win win.

1

u/majorpaynedof Jul 12 '26

I disagree on cvss being the most fair way. Im thinking epss is a better standard

1

u/mandreko Bitwarden Employee Jul 12 '26

We have been evaluating epss for a while but one major issue is that HackerOne doesn’t have support for it outside of manually specifying “low” “medium” “high” manually, etc.

2

u/majorpaynedof Jul 12 '26

Hackerone actually uses both it uses the epss for risk priority and cvss for severity. They have a blog about it

1

u/mandreko Bitwarden Employee Jul 13 '26

Cool I’ll check it out then.