CVE-2026-31835: Vaultwarden WebAuthn credential metadata tampered before signature verification
Vaultwarden is a Bitwarden-compatible server written in Rust. In versions 1.35.4 and earlier, the WebAuthn authentication flow in validatewebauthnlogin() updates persistent credential metadata (1backupeligible1 and 1backupstate flags1) based on unverified authenticatorData before signature validation is performed. An attacker who knows a user's password but cannot produce a valid WebAuthn signature can permanently modify the stored backup flags for that user's credential. If signature verification fails, the database update is not rolled back. This can result in a persistent denial of service of WebAuthn two-factor authentication for affected credentials. This issue has been fixed in version 1.35.5.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Vaultwardento a version that resolves this vulnerability.Fixed in 1.35.5
Event History
Frequently Asked Questions
What is the severity of CVE-2026-31835?
CVE-2026-31835 is classified as a high severity vulnerability due to potential unauthorized access to sensitive WebAuthn credential data.
How do I fix CVE-2026-31835?
To fix CVE-2026-31835, upgrade Vaultwarden to version 1.35.5 or later where the vulnerability is patched.
What versions of Vaultwarden are affected by CVE-2026-31835?
Vaultwarden versions up to and including 1.35.4 are affected by CVE-2026-31835.
What type of attack is CVE-2026-31835 associated with?
CVE-2026-31835 is associated with attacks leveraging tampered WebAuthn credential metadata before signature verification.
Can I rely on the WebAuthn authentication after updating to the patched version for CVE-2026-31835?
Yes, after updating to Vaultwarden version 1.35.5, the WebAuthn authentication flow will be secured against the reported vulnerability.