https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 11:49:30 +0000 https://cve.radiocsirt.org/vuln/cve-2026-31835 <p><strong>Affected:</strong> dani-garcia vaultwarden</p> <p>Vaultwarden is a Bitwarden-compatible server written in Rust. In versions 1.35.4 and earlier, the WebAuthn authentication flow in `validate_webauthn_login()` updates persistent credential metadata (1backup_eligible1 and 1backup_state flags1) based on unverified `authenticatorData` before signature validation is performed. An attacker who knows a user&#39;s password but cannot produce a valid WebAuthn signature can permanently modify the stored backup flags for that user&#39;s credential. If signature verification fails, the database update is not rolled back. This can result in a persistent denial of service of WebAuthn two-factor authentication for affected credentials. This issue has been fixed in version 1.35.5.</p> <p><strong>Affected:</strong> dani-garcia vaultwarden</p> <p>Vaultwarden is a Bitwarden-compatible server written in Rust. In versions 1.35.4 and earlier, the WebAuthn authentication flow in `validate_webauthn_login()` updates persistent credential metadata (1backup_eligible1 and 1backup_state flags1) based on unverified `authenticatorData` before signature validation is performed. An attacker who knows a user&#39;s password but cannot produce a valid WebAuthn signature can permanently modify the stored backup flags for that user&#39;s credential. If signature verification fails, the database update is not rolled back. This can result in a persistent denial of service of WebAuthn two-factor authentication for affected credentials. This issue has been fixed in version 1.35.5.</p> https://cve.radiocsirt.org/vuln/cve-2026-31835