CVE-2026-43914

Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.35.4, there is a security vulnerability in Vaultwarden that allows bypassing the login brute-force protection if email 2fa is enabled. If email 2fa is enabled, the unprotected 2fa-function send_email_login (email.rs, api endpoint /api/two-factor/send-email-login) also acts as an oracle determining whether a username-password combination is correct. An attacker can abuse that endpoint to brute-force passwords without rate-limiting. This works even for users who don't have email 2fa configured. This vulnerability is fixed in 1.35.4.

• CWE-307

• https://github.com/dani-garcia/vaultwarden/pull/6867Issue Tracking, Patch
• https://github.com/dani-garcia/vaultwarden/releases/tag/1.35.4Product, Release Notes
• https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-c5rv-q295-7w4gExploit, Patch, Vendor Advisory
• https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-c5rv-q295-7w4gExploit, Patch, Vendor Advisory

Published

May 11, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-43909OpenImageIO is a toolset for reading, writing, and manipulat…8.8
• CVE-2026-4391A security vulnerability has been detected in TeamSpeak 3 Se…6.9
• CVE-2026-43910Appium Java Client is the Java language binding for writing …8.2
• CVE-2026-43911Vaultwarden is a Bitwarden-compatible server written in Rust…8.1
• CVE-2026-43912Vaultwarden is a Bitwarden-compatible server written in Rust…8.7
• CVE-2026-43913Vaultwarden is a Bitwarden-compatible server written in Rust…8.1
• CVE-2026-43915Coturn is a free open source implementation of TURN and STUN…5.4
• CVE-2026-43916pam_authnft is a PAM session module binding nftables firewal…8.7
• CVE-2026-43917Dokploy is a free, self-hostable Platform as a Service (PaaS…5.3
• CVE-2026-43918FOSSBilling is a free, open-source billing and client manage…8.7
• CVE-2026-43919Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2026-4392A vulnerability was detected in TeamSpeak 3 Server up to 3.1…6.9