https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 09:47:53 +0000 https://cve.radiocsirt.org/vuln/cve-2026-43914 <p><strong>Affected:</strong> dani-garcia vaultwarden</p> <p>Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.35.4, there is a security vulnerability in Vaultwarden that allows bypassing the login brute-force protection if email 2fa is enabled. If email 2fa is enabled, the unprotected 2fa-function send_email_login (email.rs, api endpoint /api/two-factor/send-email-login) also acts as an oracle determining whether a username-password combination is correct. An attacker can abuse that endpoint to brute-force passwords without rate-limiting. This works even for users who don&#39;t have email 2fa configured. This vulnerability is fixed in 1.35.4.</p> <p><strong>Affected:</strong> dani-garcia vaultwarden</p> <p>Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.35.4, there is a security vulnerability in Vaultwarden that allows bypassing the login brute-force protection if email 2fa is enabled. If email 2fa is enabled, the unprotected 2fa-function send_email_login (email.rs, api endpoint /api/two-factor/send-email-login) also acts as an oracle determining whether a username-password combination is correct. An attacker can abuse that endpoint to brute-force passwords without rate-limiting. This works even for users who don&#39;t have email 2fa configured. This vulnerability is fixed in 1.35.4.</p> https://cve.radiocsirt.org/vuln/cve-2026-43914