Loading...
Skip to main content
GeekWala

CVE-2024-55225 — Vulnerability in vaultwarden — CVE Details

HIGH

Vaultwarden vulnerable to user impersonation

Published January 9, 2025Updated January 10, 2025Source: osv

Summary

An issue in the component src/api/identity.rs of Vaultwarden prior to v1.32.5 allows attackers to impersonate users, including Administrators, via a crafted authorization request.

Advisory Timeline

  • First published January 9, 2025 (641 days ago).
  • Last revised January 10, 2025 — 1 day after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Cargo
Update vaultwarden to 1.32.5 or later
cargo update -p vaultwarden --precise 1.32.5

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (1)

Affects 1 ecosystem: crates.io (1).

PackageEcosystemAffectedFixed In
vaultwarden
crates.io
All versions1.32.5

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

  • CWE-276
    Incorrect Default PermissionsMITRE
  • CWE-863
    Incorrect AuthorizationMITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 7.5 score means for each attack dimension.

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
—
Confidentiality
—
Integrity
—
Availability
—

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P

References

Frequently Asked Questions

What is CVE-2024-55225?
Vaultwarden vulnerable to user impersonation This vulnerability has been assigned a severity rating of HIGH (CVSS score: 7.5/10).
How do I check if my project is affected by CVE-2024-55225?
CVE-2024-55225 affects vaultwarden. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2024-55225 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
7.5

High exploitability or significant impact. Prioritize remediation within days.

Also Known As

GHSA-x7m9-mv49-fv73

Related CVEs

  • CVE-2026-93657
    HIGH

    hickory-resolver: Resolver::lookup() and Resolver::lookup_ip() APIs obscure DNSSEC validation failures

  • CVE-2026-18140
    HIGH

    aws-smithy-json: Uncontrolled recursion in the aws-smithy-json unknown-key skip path allows unauthenticated remote denial of service in smithy-rs generated servers

  • CVE-2026-27803
    HIGH

    Vaultwarden's Collection Management Operations Allowed Without `manage` Verification for Manager Role

  • CVE-2026-27802
    HIGH

    Vaultwarden has Privilege Escalation via Bulk Permission Update to Unauthorized Collections by Manager

  • CVE-2026-27801
    MEDIUM

    Vaultwarden has 2FA Bypass on Protected Actions due to Faulty Rate Limit Enforcement

More crates.io advisories

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies