CVE-2026-57522
LowCVSS 3.5Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
Bitwarden Server before 2026.5.0 has a JSON injection vulnerability in IntegrationTemplateProcessor.ReplaceTokens(). An authenticated organization member can set their display name to JSON metacharacters, injecting arbitrary key-value pairs into JSON payloads sent to configured event integrations (webhook, SIEM, Slack, Teams, Datadog).
Risk Assessment
An attacker can manipulate data sent to external monitoring and notification systems, potentially causing false alerts, hiding real security events, or misleading administrators.
Recommendation
Immediately upgrade Bitwarden Server to version 2026.5.0 or later, which includes the fix. Additionally, consider restricting display name changes to trusted users only.
Original NVD description (English source)
Bitwarden Server before 2026.5.0 contains a JSON injection vulnerability in IntegrationTemplateProcessor.ReplaceTokens(), which substitutes user-controlled values into event-integration templates without JSON encoding. When an organization has configured an event integration whose template references a user-controlled token (such as #ActingUserName# or #UserName#, populated from a member's display name), an authenticated member can set their display name to JSON metacharacters and inject arbitrary key-value pairs into the rendered payloads delivered to webhook, SIEM, Slack, Teams, or Datadog endpoints, making injected fields indistinguishable from legitimate template output.