CVE-2026-43914

🗓️ 11 May 2026 22:03:58Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 55 Views🌐 WEB

Vaultwarden before version 1.35.4 allows brute-force bypass via the email two-factor login endpoint acting as an oracle.

Reporter	Title	Published	Views	Family All 8
ATTACKERKB	CVE-2026-43914	11 May 202622:03	–	attackerkb
CNNVD	Vaultwarden 安全漏洞	11 May 202600:00	–	cnnvd
Cvelist	CVE-2026-43914 Vaultwarden: Brute-force protection bypass vulnerability	11 May 202622:03	–	cvelist
EUVD	EUVD-2026-29342	11 May 202622:03	–	euvd
NVD	CVE-2026-43914	11 May 202623:20	–	nvd
Positive Technologies	PT-2026-39864	11 May 202600:00	–	ptsecurity
RedhatCVE	CVE-2026-43914	12 May 202609:49	–	redhatcve
Vulnrichment	CVE-2026-43914 Vaultwarden: Brute-force protection bypass vulnerability	11 May 202622:03	–	vulnrichment

NVD

Vulners

Node

dani-garcia vaultwardenRange<1.35.4

[
  {
    "vendor": "dani-garcia",
    "product": "vaultwarden",
    "versions": [
      {
        "version": "< 1.35.4",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/dani-garcia/vaultwarden/releases/tag/1.35.4
github	www.github.com/dani-garcia/vaultwarden/pull/6867
github	www.github.com/dani-garcia/vaultwarden/security/advisories/GHSA-c5rv-q295-7w4g

Parameter	Position	Path	Description	CWE
username	request body	/api/two-factor/send-email-login	Unprotected two-factor login email endpoint can be used as an oracle to verify username/password combinations, enabling brute-force of credentials when email 2FA is enabled.	CWE-307
password	request body	/api/two-factor/send-email-login	Unprotected two-factor login email endpoint can be used as an oracle to verify username/password combinations, enabling brute-force of credentials when email 2FA is enabled.	CWE-307

17 Jun 2026 10:50Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.17.3 - 9.8

EPSS0.00288

SSVC

CWE-307