CVE-2026-43914

critical

Published 2026-05-11 · Modified 2026-05-13

CVSS v3

9.8

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2

—

VIR risk

9.8

Description

Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.35.4, there is a security vulnerability in Vaultwarden that allows bypassing the login brute-force protection if email 2fa is enabled. If email 2fa is enabled, the unprotected 2fa-function send_email_login (email.rs, api endpoint /api/two-factor/send-email-login) also acts as an oracle determining whether a username-password combination is correct. An attacker can abuse that endpoint to brute-force passwords without rate-limiting. This works even for users who don't have email 2fa configured. This vulnerability is fixed in 1.35.4.

Predictions

Exploit likelihood

97%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

Vendor advisory: security-advisories@github.com — https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-c5rv-q295-7w4g

vendor Authored 2026-05-27

Vendor advisory: security-advisories@github.com — https://github.com/dani-garcia/vaultwarden/releases/tag/1.35.4

vendor Authored 2026-05-27

Vendor advisory: security-advisories@github.com — https://github.com/dani-garcia/vaultwarden/pull/6867

Application impact

Vendor	Product	Versions	Fixed
dani-garcia	vaultwarden	`{"endExcluding":"1.35.4"}`	`1.35.4`

References

CWEs

CWE-307

Verify integrity in audit chain (admin only). AS-IS.