CVE-2026-43914

The record

Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.35.4, there is a security vulnerability in Vaultwarden that allows bypassing the login brute-force protection if email 2fa is enabled. If email 2fa is enabled, the unprotected 2fa-function send_email_login (email.rs, api endpoint /api/two-factor/send-email-login) also acts as an oracle determining whether a username-password combination is correct. An attacker can abuse that endpoint to brute-force passwords without rate-limiting. This works even for users who don't have email 2fa configured. This vulnerability is fixed in 1.35.4.

Affected packages

Related vulnerabilities

• CVE-2026-89174 Smart Video Intercom System developed by Kingdom Communication Associated has a Missing… CWE-307
• CVE-2026-88770 A flaw was found in the Device Authorization Grant flow of Keycloak, an identity and… CWE-307
• CVE-2026-78490 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions… CWE-307
• CVE-2026-86729 WWBN AVideo through commit e01e41ecc (no patched version available) exposes… CWE-307
• CVE-2026-20514 In Audio HAL, there is a possible information disclosure due to a missing permission… CWE-307
• CVE-2026-20512 In Audio HAL, there is a possible escalation of privilege due to improper input… CWE-307
• CVE-2026-86186 AVideo API fails to enforce rate limits when clients send a bot User-Agent header… CWE-307
• CVE-2026-85237 A vulnerability in MISP's email-based one-time password (OTP) authentication flow allowed… CWE-307