Vaultwarden, a Bitwarden-compatible server written in Rust, has a vulnerability (CVE-2026-43914) affecting versions before 1.35.4. The vulnerability involves improper restriction of excessive authentication attempts (CWE-307). Specifically, the send_email_login API endpoint used for email 2FA can be abused as an oracle to confirm valid username-password pairs without rate limiting, enabling brute-force attacks. This bypass affects all users, including those without email 2FA enabled. The vulnerability is resolved in Vaultwarden version 1.35.4.

An attacker can perform brute-force password attacks against Vaultwarden user accounts by abusing the unprotected 2FA email login endpoint. This can lead to unauthorized access, compromising confidentiality, integrity, and availability of user data. The vulnerability affects all users on vulnerable versions regardless of whether they have email 2FA enabled. No known exploits in the wild have been reported as of the published date.

Upgrade Vaultwarden to version 1.35.4 or later, where this vulnerability is fixed. Since no official patch links or vendor advisory content are provided, confirm the upgrade from the official Vaultwarden release notes or repository. Until upgraded, be aware that brute-force protections can be bypassed via the email 2FA endpoint.