CVE-2023-27706

Bitwarden Windows desktop application versions prior to v2023.4.0 store biometric keys in Windows Credential Manager, accessible to other local unprivileged processes.

CVSS v3.1 NVD

7.1 HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

EPSS

0.58% chance of exploitation in the next 30 days, 47th percentile

Published

2023-06-09

Updated

2025-01-06

Proof-of-concept exploits (1)

• RedTeamPentesting/bitwarden-windows-hello32★ · 2024-01-03

Security advisories

• https://hackerone.com/reports/1874155
• bitwarden/clients

References

• CVE Record
• NVD entry

Related

• CVE-2020-13935
• CVE-2023-33243
• CVE-2024-6592
• CVE-2024-6593
• CVE-2024-6594