Vaultwarden, an unofficial Bitwarden-compatible server, contains a flaw that permits a two‑factor authentication bypass during protected operations. After an attacker gains authenticated access to a user account, the system fails to enforce rate limiting, enabling the attacker to execute privileged actions that normally require 2FA, including retrieving API keys and deleting the victim’s vault and associated organisations. The vulnerability is a classic authentication bypass (CWE‑307) which directly undermines the confidentiality and integrity of user data.

The issue affects all instances of Vaultwarden version 1.34.3 and earlier. The vendor, dani‑garcia, has released version 1.35.0 which addresses the problem. Users running older versions are therefore exposed.

The CVSS score of 6 indicates a moderate severity, and the EPSS score of less than 1% suggests that exploitation attempts are unlikely to be widespread, especially since the attacker must already possess authenticated credentials. The vulnerability is not listed in the CISA KEV catalog, but it still poses a significant risk to accounts with high privilege, as the bypass allows full control over sensitive data and account structure. The attack vector is inferred to be remote, requiring prior authentication; attackers could obtain credentials through phishing, credential stuffing, or other enumeration techniques, after which the rate‑limit flaw can be leveraged to bypass 2FA requirements.