High severity7.5NVD Advisory· Published Mar 9, 2023· Updated Jun 17, 2026
CVE-2018-25081
CVE-2018-25081
Description
Bitwarden through 2023.2.1 offers password auto-fill within a cross-domain IFRAME element. NOTE: the vendor's position is that there have been important legitimate cross-domain configurations (e.g., an apple.com IFRAME element on the icloud.com website) and that "Auto-fill on page load" is not enabled by default.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3Patches
Vulnerability mechanics
References
4- flashpoint.io/blog/bitwarden-password-pilfering/nvdExploitThird Party Advisory
- cdn.bitwarden.net/misc/Bitwarden%20Security%20Assessment%20Report.pdfnvdTechnical DescriptionVendor Advisory
- news.ycombinator.com/itemnvdThird Party Advisory
- github.com/bitwarden/clients/releasesnvdRelease Notes
News mentions
0No linked articles in our index yet.