Vaultwarden
CVE-2026-27801
MEDIUM
GHSA-v6pg-v89r-w8wr
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
4DescriptionGitHub Advisory
Vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs. Vaultwarden versions 1.34.3 and prior are susceptible to a 2FA bypass when performing protected actions. An attacker who gains authenticated access to a user’s account can exploit this bypass to perform protected actions such as accessing the user’s API key or deleting the user’s vault and organisations the user is an admin/owner of . This issue has been patched in version 1.35.0.
AnalysisAI
Two-factor authentication bypass in Vaultwarden 1.34.3 and earlier allows authenticated attackers to circumvent 2FA protections on sensitive operations, enabling unauthorized access to API keys and destructive actions against vaults and organizations. Public exploit code exists for this vulnerability, which affects the unofficial Bitwarden-compatible server and currently lacks an available patch. Attackers with legitimate account credentials can escalate privileges to perform administrative actions typically restricted by 2FA controls.
Technical ContextAI
Classified as CWE-307 (Improper Restriction of Excessive Authentication Attempts). Affects Vaultwarden. Vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs. Vaultwarden versions 1.34.3 and prior are susceptible to a 2FA bypass when performing protected actions. An attacker who gains authenticated access to a user’s account can exploit this bypass to perform protected actions such as accessing the user’s API key or deleting the user’s vault and organisations the user is an admin/owner of . This issue has been patched in version 1.35.0.
RemediationAI
Fixed in version 1.35.0.. Restrict network access to the affected service where possible.
More in Vaultwarden
View allCross-organization authorization bypass in Vaultwarden (the Rust-based, self-hosted Bitwarden-compatible server) prior t
Vaultwarden versions prior to 1.35.4 fail to properly enforce collection management permissions, allowing authenticated
Vaultwarden versions before 1.35.4 contain a privilege escalation vulnerability that allows authenticated Manager-level
Session hijacking via a broken SSO/OAuth authorization flow affects Vaultwarden (the Rust-based Bitwarden-compatible ser
Improper authorization in Vaultwarden (self-hosted Bitwarden-compatible server) before 1.35.5 lets an authenticated user
Authentication bypass (account takeover) in Vaultwarden before 1.36.0 allows an attacker who controls a federated identi
vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs. Rated high sev
Brute-force protection bypass in Vaultwarden (the Rust Bitwarden-compatible server) before 1.35.4 lets unauthenticated r
Vaultwarden's SSO discovery endpoint exposed real organization SSO metadata - including organizationIdentifier values -
Insufficient session expiration in Vaultwarden prior to 1.35.5 allows an attacker holding a previously obtained refresh
Vaultwarden versions prior to 1.35.3 allow authenticated organization members to bypass collection-level access controls
Server-side request forgery (SSRF) in Vaultwarden's icon fetching endpoint allows blind internal network and port discov
Same technique Authentication Bypass
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today