Bitwarden Server before 2026.5.0 contains a JSON injection vulnerability in IntegrationTemplateProcessor.ReplaceTokens(), which substitutes user-controlled values into event-integration templates without JSON encoding. When an organization has configured an event integration whose template references a user-controlled token (such as #ActingUserName# or #UserName#, populated from a member's display name), an authenticated member can set their display name to JSON metacharacters and inject arbitrary key-value pairs into the rendered payloads delivered to webhook, SIEM, Slack, Teams, or Datadog endpoints, making injected fields indistinguishable from legitimate template output.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
Present
Additional conditions required
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
None
No data leak
Integrity
Low
Partial data modification
Availability
None
No disruption
CVSS Vector v4.0
Weakness Type (CWE)
Vulnerable Products 1
| Configuration | From (including) | Up to (excluding) |
|---|---|---|
|
Bitwarden Server
cpe:2.3:a:bitwarden:server:*:*:*:*:*:*:*:*
|
— |
2026.5.0
|
References 5
https://github.com/bitwarden/server/commit/a26afd18130ef985ede5c97d277820d04518…
disclosure@vulncheck.com
https://github.com/bitwarden/server/pull/7593
disclosure@vulncheck.com
https://github.com/bitwarden/server/releases/tag/v2026.5.0
disclosure@vulncheck.com
https://sanjokkarki.com.np/blog/bitwarden-webhook-json-injection
disclosure@vulncheck.com
https://www.vulncheck.com/advisories/bitwarden-server-json-injection-via-webhoo…
disclosure@vulncheck.com