Bitwarden Server 1.35.1 allows SSRF because it does not consider certain IPv6 addresses (ones beginning with fc, fd, fe, or ff, and the :: address) and certain IPv4 addresses (0.0.0.0/8, 127.0.0.0/8, and 169.254.0.0/16).
Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15879
Reference (s):
- https://github.com/bitwarden/server/pull/827