CVE-2026-43914: Vaultwarden: Brute-force protection bypass vulnerability
Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.35.4, there is a security vulnerability in Vaultwarden that allows bypassing the login brute-force protection if email 2fa is enabled. If email 2fa is enabled, the unprotected 2fa-function sendemaillogin (email.rs, api endpoint /api/two-factor/send-email-login) also acts as an oracle determining whether a username-password combination is correct. An attacker can abuse that endpoint to brute-force passwords without rate-limiting. This works even for users who don't have email 2fa configured. This vulnerability is fixed in 1.35.4.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2026-43914?
CVE-2026-43914 is classified as a medium severity vulnerability due to the potential for unauthorized access through bypassing brute-force protections.
How do I fix CVE-2026-43914?
To fix CVE-2026-43914, upgrade Vaultwarden to version 1.35.4 or later.
What does CVE-2026-43914 affect?
CVE-2026-43914 affects Vaultwarden versions prior to 1.35.4 that have email 2FA enabled.
What type of vulnerability is CVE-2026-43914?
CVE-2026-43914 is a brute-force protection bypass vulnerability.
Can I still use Vaultwarden with CVE-2026-43914?
While you can still use Vaultwarden with CVE-2026-43914 present, it is recommended to upgrade to avoid security risks.