In Vaultwarden versions 1.35.4 and earlier, the WebAuthn login flow updates credential backup flags in persistent storage before it validates the WebAuthn signature. If an attacker knows a user’s password but cannot produce a valid WebAuthn signature, the update proceeds and the signature check fails, leaving the credential permanently marked as non‑backupable. The affected flags are not rolled back on signature failure, resulting in a durable loss of WebAuthn two‑factor protection for that credential. This flaw falls under CWE‑345, which deals with authenticated data tampering before proper verification.

The vulnerability impacts the Vaultwarden server developed by dani‑garcia. All releases up to and including 1.35.4 are affected; the issue was addressed in version 1.35.5. No other vendors or products are listed.

The CVSS score of 5.3 indicates a moderate severity. Although the EPSS score is not provided and the vulnerability is not listed in the CISA KEV catalog, the attack model is relatively low effort: an attacker who possesses a user’s password can trigger the flag modification without needing a WebAuthn device. The potential impact is permanent denial of a critical authentication factor for the affected user, thereby reducing account security. The risk is primarily limited to individuals who already have a valid account password and can perform API or web login attempts with invalid WebAuthn data.