CVE-2026-43914: falha de alta gravidade em dani-garcia vaultwarden
Vaultwarden: Brute-force protection bypass vulnerability
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.3epss 0.3%
Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.35.4, there is a security vulnerability in Vaultwarden that allows bypassing the login brute-force protection if email 2fa is enabled. If email 2fa is enabled, the unprotected 2fa-function send_email_login (email.rs, api endpoint /api/two-factor/send-email-login) also acts as an oracle determining whether a username-password combination is correct. An attacker can abuse that endpoint to brute-force passwords without rate-limiting. This works even for users who don't have email 2fa configured. This vulnerability is fixed in 1.35.4.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Produtos afetados
dani-garcia · vaultwardenCVEs relacionadas — dani-garcia vaultwarden
No mesmo produto, das mais perigosas para as menos.
CVE-2025-24364HIGHvaultwarden allows RCE in the admin panelEPSS 1.0%CVE-2025-24365HIGHvaultwarden allows escalation of privilege via variable confusion in OrgHeaders traitEPSS 0.7%CVE-2026-47159MEDIUMVaultwarden: Authentication Flow Information Disclosure in SSO Discovery Allows Organization Enumeration and Pre-Validation Token ExposureEPSS 0.5%CVE-2026-26012MEDIUMvaultwarden has Full Cipher Enumeration Ignoring Organization Collection PermissionsEPSS 0.5%CVE-2026-47164HIGHVaultwarden: SSO Email Auto-Link Can Bind an Existing Local Account to an Attacker-Controlled IdP IdentityEPSS 0.4%CVE-2026-95814HIGHVaultwarden through 1.37.3 Authorization Bypass via Missing Status CheckEPSS 0.4%