Bug bounty program

Bitwarden

Platform: HackerOne
Bounties: None
Assets in scope: 21
Disclosed reports: 11
Subdomains: 77
Vendor on CyberSIXT: Bitwarden (17 CVEs, 0 exploited)

Most upvoted reports11

Most upvoted reports of Bitwarden
Report	Weakness	Disclosed	Bounty	Votes
Bypass for forced re-authentication upon biometrics changeAnalysed#1929915	Authentication	2023-07-19	–	37
Organization Admin Privilege Escalation To OwnerAnalysed#272570	Input Validation and Logic	2017-10-28	–	28
Vulnerable exported broadcast receiverAnalysed#289000	Misconfiguration and Insecure Design	2017-11-10	–	24
Blind HTTP GET SSRF via website icon fetch (bypass of pull#812)Analysed#925527	Server-Side Request Forgery	2020-09-11	–	21
Biometric key is stored in Windows Credential Manager, accessible to other local unprivileged processesAnalysed#1874155	Cryptography	2023-06-07	–	19
Mailgun misconfiguration on email.bitwarden.comAnalysed#272357	Input Validation and Logic	2017-10-27	–	17
Server-Side Request Forgery in "icons.bitwarden.net"Analysed#913276	Server-Side Request Forgery	2020-08-07	–	13
Rate limits too low for email 2FA#979820	Authentication	2020-10-14	–	11
When uploading attachments, unencrypted file names are made available to the server#1206799	Cryptography	2021-08-02	–	8
Tracking Bitwarden firefox addon users#337189	No weakness recorded	2018-05-23	–	7

Weaknesses of its reports

In scope

Web applications7 assetsapi.bitwarden.com · bitwarden.com · docs.passwordless.dev · help.bitwarden.com · identity.bitwarden.com · v4.passwordless.dev · vault.bitwarden.com
Source code6 assetshttps://github.com/bitwarden · https://github.com/bitwarden/android · https://github.com/bitwarden/clients · https://github.com/bitwarden/ios · https://github.com/bitwarden/sdk-internal · https://github.com/bitwarden/server
Mobile apps4 assets9pjsdv0vpk04 · com.8bit.bitwarden · com.bitwarden.authenticator · com.x8bit.bitwarden
Other assets4 assetshttps://addons.mozilla.org/en-US/firefox/addon/bitwarden-password-manager/ · https://addons.opera.com/extensions/details/bitwarden-free-password-manager/ · https://safari-extensions.apple.com/details/?id=com.bitwarden.safari-LTZ2PFU5D6 · https://www.npmjs.com/package/@bitwarden/mcp-server

Subdomains77

Root

bitwarden.com77

Scope

Name suggests:Mail

First seen

Text fileClear filters2 names

Subdomains of Bitwarden
Name	Scope	First seen
mail.bitwarden.commail	Not in the scope	2026-11-14
o1.mail1.bitwarden.commail	Not in the scope	2026-11-14

4 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.