Vaultwarden, a Bitwarden-compatible server built in Rust, contains a flaw that lets an attacker bypass login brute‑force protection when email two‑factor authentication (2FA) is enabled. The send_email_login endpoint does not enforce rate‑limiting and also serves as an oracle that confirms whether a username‑password combination is valid. This enables attackers to iterate over passwords without limitation, effectively compromising accounts.

Affected vendors and products include the open‑source Vaultwarden server maintained by dani‑garcia. Any installation running a version earlier than 1.35.4 is susceptible. The issue is fixed in release 1.35.4 and later; no further version information is provided by the CNA.

The CVSS score of 7.3 indicates a medium‑to‑high severity, and the lack of EPSS data suggests no current exploitation reports but the vulnerability could be readily abused over the network. It is inferred that the endpoint is publicly accessible and operates without prior authentication, because the CVE description indicates that the endpoint can be used as a password oracle without requiring logged‑in status. This broadens the attack surface. The vulnerability’s presence in the KEV catalog is not reported, but the risk remains significant for any organization that has not upgraded or mitigated the exposed endpoint.