CVE-2024-39924

An issue was discovered in Vaultwarden (formerly Bitwarden_RS) 1.30.3. A vulnerability has been identified in the authentication and authorization process of the endpoint responsible for altering the metadata of an emergency access. It permits an attacker with granted emergency access to escalate their privileges by changing the access level and modifying the wait time. Consequently, the attacker can gain full control over the vault (when only intended to have read access) while bypassing the necessary wait period.

• CWE-276

• https://github.com/dani-garcia/vaultwarden/blob/1.30.3/src/api/core/emergency_access.rs#L115-L148Product
• https://github.com/dani-garcia/vaultwarden/releases/tag/1.32.0Release Notes
• https://www.mgm-sp.com/cve/missing-authentication-check-for-emergency-accessThird Party Advisory

Published

Sep 13, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-39919@jmondi/url-to-png is an open source URL to PNG utility feat…3.1
• CVE-2024-3992The Amen WordPress plugin through 3.3.1 does not sanitise an…4.8
• CVE-2024-39920The TCP protocol in RFC 9293 has a timing side channel that …4.3
• CVE-2024-39921Observable timing discrepancy issue exists in IPCOM EX2 Seri…7.5
• CVE-2024-39922A vulnerability has been identified in LOGO! 12/24RCE (6ED10…5.1
• CVE-2024-39923An issue was discovered in Mahara 24.04 before 24.04.2 and 2…6.1
• CVE-2024-39925An issue was discovered in Vaultwarden (formerly Bitwarden_R…6.5
• CVE-2024-39926An issue was discovered in Vaultwarden (formerly Bitwarden_R…5.4
• CVE-2024-39927Out-of-bounds write vulnerability exists in Ricoh MFPs and p…8.2
• CVE-2024-39928In Apache Linkis <= 1.5.0, a Random string security vulnerab…7.5
• CVE-2024-39929Exim through 4.97.1 misparses a multiline RFC 2231 header fi…5.4
• CVE-2024-3993The AZAN Plugin WordPress plugin through 0.6 does not have C…4.6