CVE-2026-43914 is a brute force protection bypass (CVSS 7.3, high) in Vaultwarden before 1.35.4. With email two factor enabled on the server, the send email login endpoint reveals whether a password is correct and is not rate limited. Upgrade to Vaultwarden 1.35.4.
What's affected
The advisory lists Vaultwarden versions before 1.35.4, with 1.35.4 as the patched release. The NVD record says the same.
The condition is that email 2FA is enabled on the server. The advisory notes the guessing works even against users who have not set up email 2FA themselves.
How to check if you're exposed
- Check the Vaultwarden version. If you use Docker, read the image tag. The admin page shows diagnostics if you enabled it.
- Check whether email two factor is enabled in your server configuration.
- Search the access log for many POST requests to the path /api/two-factor/send-email-login from one address or a small set of addresses.
What to do now
- Upgrade to Vaultwarden 1.35.4 or later.
- Use long, unique master passwords, since the attack is password guessing.
- Put the server behind a reverse proxy with its own rate limiting on the login paths.
- Enable app or hardware based two factor for accounts.
- Review the access logs for repeated requests to the send email login endpoint.
Why it matters
The weakness is CWE-307, improper restriction of excessive authentication attempts. The server rate limits password, SSO and API key logins. The email 2FA send endpoint was outside that limit, and it responded differently depending on whether the password was right, so it worked as a free test for each guess.
A rate limit protects only the paths it covers. This is a good case for a limit at the proxy as well. The KEV flag is false.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Do users without email 2FA face risk?
The advisory says the guessing works even for users who do not have email 2FA configured, once it is enabled on the server.
Sources
Last reviewed: 19 October 2026.
