Vulnerability · Published May 11, 2026 · Assigned by GitHub_M

CVE-2026-43914Vaultwarden: Brute-force protection bypass vulnerability

High 7.3

In plain English

A high-severity security flaw in vaultwarden from dani-garcia. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)7.3High

Exploit odds (30 days)0.3%top 78.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack tooling1Public PoC

Official description

Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.35.4, there is a security vulnerability in Vaultwarden that allows bypassing the login brute-force protection if email 2fa is enabled. If email 2fa is enabled, the unprotected 2fa-function send_email_login (email.rs, api endpoint /api/two-factor/send-email-login) also acts as an oracle determining whether a username-password combination is correct. An attacker can abuse that endpoint to brute-force passwords without rate-limiting. This works even for users who don't have email 2fa configured. This vulnerability is fixed in 1.35.4.

Affected products (as reported)

Vendor	Product	Versions
dani-garcia	vaultwarden	< 1.35.4

Weakness: CWE-307 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

References

https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-c5rv-q295-7w4g x_refsource_CONFIRM
https://github.com/dani-garcia/vaultwarden/pull/6867 x_refsource_MISC
https://github.com/dani-garcia/vaultwarden/releases/tag/1.35.4 x_refsource_MISC