crítica
CVE-2026-43914
Vaultwarden is a Bitwarden-compatible server written in Rust. Pri ...
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD.
Descripción
Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.35.4, there is a security vulnerability in Vaultwarden that allows bypassing the login brute-force protection if email 2fa is enabled. If email 2fa is enabled, the unprotected 2fa-function send_email_login (email.rs, api endpoint /api/two-factor/send-email-login) also acts as an oracle determining whether a username-password combination is correct. An attacker can abuse that endpoint to brute-force passwords without rate-limiting. This works even for users who don't have email 2fa configured. This vulnerability is fixed in 1.35.4.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| rapidfort alpine 3.20 | vaultwarden | 1.35.4-r0 |
| rapidfort alpine 3.21 | vaultwarden | 1.35.4-r0 |
| rapidfort alpine 3.22 | vaultwarden | 1.35.4-r0 |
| rapidfort alpine 3.23 | vaultwarden | 1.35.4-r0 |
| rapidfort fedora 43 | vaultwarden | 1.36.0-1.fc43 |
| rapidfort Oracle Linux 10 | vaultwarden | 1.36.0-1.el10_2 |
| rapidfort Oracle Linux 9 | vaultwarden | 1.36.0-1.el9 |