CVE-2026-43914-PoC

CVE-2026-43914 — Vaultwarden Email-2FA Brute-Force Protection Bypass Proof-of-concept for CVE-2026-43914 : when Email 2FA is enabled, Vaultwarden's login brute-force protection can be completely bypassed via the unauthenticated POST /api/two-factor/send-email-login endpoint, which acts as an...

Bitwarden: Rate limits too low for email 2FA

NO RATE LIMIT ON 2FA CAN LEAD TO ACCOUNT COMPROMISE! 1. Create account on vault.bitwarden.com if you don't have. 2.Setup 2FA via email 3.Logout and log in again. This time along with password you have to fill the 2fa code which is sent to the email. 4.Type Any Random number, intercept request wit...