Bypass in Two-Factor Authentication Functionality in Vaultwarden from dani-garcia

CVE-2026-43914

What is CVE-2026-43914?

A security flaw in Vaultwarden prior to version 1.35.4 allows attackers to bypass login brute-force protections when email two-factor authentication (2FA) is enabled. This vulnerability exposes the '/api/two-factor/send-email-login' endpoint as an oracle, letting attackers determine the validity of usernames without triggering rate-limiting. Consequently, even users without email 2FA configured face potential security threats as their accounts could be exploited through brute-force attacks. This issue has been resolved in version 1.35.4.

References