An issue in the component src/api/identity.rs of Vaultwarden prior to v1.32.5 allows attackers to impersonate users, including Administrators, via a crafted authorization request.
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| https://github.com/dani-garcia/vaultwarden/releases/tag/1.32.4 | Release Notes |
| https://github.com/dani-garcia/vaultwarden/releases/tag/1.32.5 | Release Notes |
| https://insinuator.net/2024/11/vulnerability-disclosure-authentication-bypass-in-vaultwarden-versions-1-32-5/ | Third Party Advisory |
Configurations
History
20 Jun 2025, 18:29
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:dani-garcia:vaultwarden:*:*:*:*:*:*:*:* | |
| References | () https://insinuator.net/2024/11/vulnerability-disclosure-authentication-bypass-in-vaultwarden-versions-1-32-5/ - Third Party Advisory | |
| References | () https://github.com/dani-garcia/vaultwarden/releases/tag/1.32.5 - Release Notes | |
| References | () https://github.com/dani-garcia/vaultwarden/releases/tag/1.32.4 - Release Notes | |
| First Time |
Dani-garcia vaultwarden
Dani-garcia |
09 Jan 2025, 21:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-01-09 21:15
Updated : 2025-06-20 18:29
NVD link : CVE-2024-55225
Mitre link : CVE-2024-55225
JSON object : View
Products Affected
dani-garcia
- vaultwarden
CWE
No CWE.