Horizon Alert
Summary of the vulnerability and why it matters
This vulnerability in Vaultwarden, a Bitwarden-compatible server, allows attackers to bypass login brute-force protections if email 2FA is enabled. The issue exploits a function intended for sending 2FA emails, which can inadvertently reveal if a username and password combination is correct, enabling password guessing without rate limits. This affects users even if they haven't configured email 2FA.
- Can lead to unauthorized account access.
- Affects any user with email 2FA enabled.
- Requires access to the login endpoint.
Attack Path
How an attacker could exploit the issue
An attacker can bypass Vaultwarden's login brute-force protection by sending requests to an unprotected API endpoint that's meant for email 2FA. This endpoint will reveal whether a username and password combination is valid, allowing an attacker to rapidly guess credentials without triggering rate limits. This attack is possible even for users without email 2FA configured.
- Unauthenticated network access required.
- Target the `/api/two-factor/send-email-login` endpoint.
- Exploitable if email 2FA is enabled.
Live Threat
Current exploitation, exposure, and threat context
This vulnerability in Vaultwarden allows attackers to bypass brute-force protection by exploiting the email 2FA function, potentially enabling them to guess credentials. Because Vaultwarden is often exposed to the internet, this could be attractive to attackers seeking to compromise user accounts for credential stuffing or further network access.
- No reported exploitation in the wild.
- Public exploit code is available.
- Fix released in version 1.35.4.
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
Teams should prioritize updating Vaultwarden to version 1.35.4 to fix a critical vulnerability that bypasses brute-force protection, allowing attackers to guess credentials. If immediate patching is not possible, implement strict rate limiting on the `/api/two-factor/send-email-login` endpoint and monitor for suspicious login attempts.
- Update Vaultwarden to 1.35.4.
- Rate-limit email 2FA endpoint.
- Monitor login activity for anomalies.
