Browse / Bitwarden

Bitwarden

See its reports on the map

Attack surface: 77 known subdomains

Not every host here is in scope. Check the program's policy before testing. Last updated 2026-11-13.

What gets reported to Bitwarden

• Authentication2
• Business Logic2
• Server-Side Request Forgery2
• Information Disclosure2
• Misconfiguration1
• Other weaknesses1

Most upvoted reports

AllValidInformativeN/ADuplicate

1. Bypass for forced re-authentication upon biometrics changeImproper Authentication - Generic · medium
   37 votes
2. Organization Admin Privilege Escalation To OwnerBusiness Logic Errors · medium
   28 votes
3. Vulnerable exported broadcast receiverViolation of Secure Design Principles · low
   24 votes
4. Blind HTTP GET SSRF via website icon fetch (bypass of pull#812)Server-Side Request Forgery (SSRF) · low
   21 votes
5. Biometric key is stored in Windows Credential Manager, accessible to other local unprivileged processesCleartext Storage of Sensitive Information · medium
   19 votes
6. Mailgun misconfiguration on email.bitwarden.comBusiness Logic Errors · low
   17 votes
7. Server-Side Request Forgery in "icons.bitwarden.net"Server-Side Request Forgery (SSRF) · medium
   13 votes
8. Rate limits too low for email 2FAImproper Restriction of Authentication Attempts · medium
   11 votes
9. When uploading attachments, unencrypted file names are made available to the serverMissing Encryption of Sensitive Data
   8 votes
10. Tracking Bitwarden firefox addon usershigh
    7 votes