In Vaultwarden (a Bitwarden-compatible server written in Rust), versions prior to 1.35.5 have a vulnerability (CWE-345) in the WebAuthn login validation function. The function updates persistent credential metadata flags (backup_eligible and backup_state) using unverified authenticatorData before the WebAuthn signature is validated. If the signature verification fails, the database update is not reverted, allowing an attacker with knowledge of the user's password but without a valid WebAuthn signature to permanently alter these flags. This can cause a persistent denial of service for WebAuthn two-factor authentication on affected credentials. The vulnerability is addressed in version 1.35.5.

The vulnerability allows an attacker who knows a user's password but cannot produce a valid WebAuthn signature to permanently modify backup-related credential flags, resulting in a persistent denial of service of WebAuthn two-factor authentication for the affected user credentials. This undermines the availability of the two-factor authentication mechanism but does not directly lead to credential compromise or privilege escalation.

Upgrade Vaultwarden to version 1.35.5 or later, where this issue has been fixed. Since this is a vulnerability in the application code, applying the official patch version is the recommended remediation. Patch status is confirmed by the vendor advisory stating the fix in version 1.35.5.