by Kastro
Paper/Archive/CVE-2026-43914

CVE-2026-43914

dani-garcia vaultwarden — Vaultwarden: Brute-force protection bypass vulnerability

EPSS 0.3%public exploitCVSS 9.8
critical.is priorityof 100
44
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 21.4.214 × 204.3Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.35.4, there is a security vulnerability in Vaultwarden that allows bypassing the login brute-force protection if email 2fa is enabled. If email 2fa is enabled, the unprotected 2fa-function send_email_login (email.rs, api endpoint /api/two-factor/send-email-login) also acts as an oracle determining whether a username-password combination is correct. An attacker can abuse that endpoint to brute-force passwords without rate-limiting. This works even for users who don't have email 2fa configured. This vulnerability is fixed in 1.35.4.

Affected

ProductAffectedFixed inSource
vaultwarden< 1.35.4–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GitHub_M (CNA)7.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: partial

References

exploitgithub.com/dani-garcia/vaultwarden/security/advisories/GHSA-c5rv-q295-7w4grefgithub.com/dani-garcia/vaultwarden/pull/6867refgithub.com/dani-garcia/vaultwarden/releases/tag/1.35.4