PT-2026-39864 · Unknown · Vaultwarden

Robert-Fl · Published 2026-05-11 · Updated 2026-05-12 · CVE-2026-43914

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Vaultwarden versions prior to 1.35.4

Description A flaw in the login brute-force protection allows attackers to determine if a username and password combination is correct when email two-factor authentication (2FA) is enabled. The API endpoint "/api/two-factor/send-email-login" and its associated function send email login() act as an oracle, enabling password brute-forcing without rate-limiting. This issue affects all users, including those who have not configured email 2FA.

Recommendations Update to version 1.35.4.

Exploit

Fix

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-307

Related Identifiers

CVE-2026-43914

Affected Products

Vaultwarden

References · 6

• 🔥 https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-c5rv-q295-7w4g · Exploit
• https://github.com/dani-garcia/vaultwarden/pull/6867 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-43914 · Security Note
• https://github.com/dani-garcia/vaultwarden/releases/tag/1.35.4 · Note
• https://t.me/CVEtracker/53436 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2054153692941623472 · Twitter Post