Two 10-year old children caught in the blast are reported to have suffered hearing damage.
The bomb went off in one of the capital's busiest streets, Goya Street, just after midnight local time (2300GMT) - a time when it is normally thronged with people.
There was a telephone warning about seven minutes before the explosion from the Basque separatist organisation, ETA, which has claimed responsibility for several attacks recently.
The man who was seriously hurt was a security officer guarding a bank, who was trapped under fallen debris. His condition is not thought to be life-threatening.
Two 10-year old children caught in the blast are reported to have suffered hearing damage.
Most of the other victims were treated for minor injuries caused by flying glass.
The Spanish Interior Minister, Mariano Rajoy, told reporters at the scene that it could have been a massacre.
"Once again, this shows that ETA is a gang of killers," he said.
But no-one has so far claimed responsibility for the blast.
The bomb went off just a few minutes after the electoral campaigns for the Basque parliament were due to close. The regional elections are to be held on Sunday.
Earlier in the day, Basque politicians joined pacifists rallying for an end to violence in the Basque region ahead of Sunday's vote.
Anti-independence challenge
Opinion polls suggest that anti-independence parties have a good chance of winning a majority in the Basque parliament and presidency.
Last Sunday, a senior official of Spain's governing party was shot dead in the northern Aragon region, in an attack attributed to ETA.
ETA called off a 14-month ceasefire in November 1999, and has since been blamed for at least 30 deaths.
The group has killed some 800 people in its decades-long armed struggle to win an independent homeland in the Basque region.