dani-garcia vaultwarden up to 1.34.x 2FA excessive authentication

Summaryinfo

A vulnerability was found in dani-garcia vaultwarden up to 1.34.x. It has been declared as problematic. This issue affects some unknown processing of the component 2FA. The manipulation results in excessive authentication. This vulnerability was named CVE-2026-27801. The attack may be performed from remote. There is no available exploit. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic has been found in dani-garcia vaultwarden up to 1.34.x. Affected is some unknown processing of the component 2FA. The manipulation with an unknown input leads to a excessive authentication vulnerability. CWE is classifying the issue as CWE-307. The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks. This is going to have an impact on confidentiality. CVE summarizes:

Vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs. Vaultwarden versions 1.34.3 and prior are susceptible to a 2FA bypass when performing protected actions. An attacker who gains authenticated access to a user’s account can exploit this bypass to perform protected actions such as accessing the user’s API key or deleting the user’s vault and organisations the user is an admin/owner of . This issue has been patched in version 1.35.0.

The advisory is available at github.com. This vulnerability is traded as CVE-2026-27801 since 02/24/2026. The exploitability is told to be difficult. It is possible to launch the attack remotely. The technical details are unknown and an exploit is not available. This vulnerability is assigned to T1110.001 by the MITRE ATT&CK project.

Upgrading to version 1.35.0 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at CERT Bund (WID-SEC-2026-0594). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Affected

• Open Source Vaultwarden

Productinfo

Vendor

• dani-garcia

Name

• vaultwarden

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10
• 1.11
• 1.12
• 1.13
• 1.14
• 1.15
• 1.16
• 1.17
• 1.18
• 1.19
• 1.20
• 1.21
• 1.22
• 1.23
• 1.24
• 1.25
• 1.26
• 1.27
• 1.28
• 1.29
• 1.30
• 1.31
• 1.32
• 1.33
• 1.34

Website

• Product: https://github.com/dani-garcia/vaultwarden/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion