NIXPKGS-2026-0515
GitHub issue
published on 5 Mar 2026
by @LeSuisse Activity log
- Created automatic suggestion
- @LeSuisse removed package vaultwarden-webvault
- @LeSuisse accepted
-
@LeSuisse
removed
2 maintainers
- @dotlambda
- @SuperSandro2000
- @LeSuisse published on GitHub
Vaultwarden: 2FA Bypass on Protected Actions due to Faulty Rate Limit Enforcement
Vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs. Vaultwarden versions 1.34.3 and prior are susceptible to a 2FA bypass when performing protected actions. An attacker who gains authenticated access to a user’s account can exploit this bypass to perform protected actions such as accessing the user’s API key or deleting the user’s vault and organisations the user is an admin/owner of . This issue has been patched in version 1.35.0.
References
Affected products
vaultwarden
- ==< 1.35.0
Matching in nixpkgs
pkgs.vaultwarden
Unofficial Bitwarden compatible server written in Rust
pkgs.vaultwarden-mysql
Unofficial Bitwarden compatible server written in Rust
pkgs.vaultwarden-sqlite
Unofficial Bitwarden compatible server written in Rust
Ignored packages (1)
pkgs.vaultwarden-webvault
Integrates the web vault into vaultwarden
-
nixos-unstable 2026.1.1+0
- nixpkgs-unstable 2026.1.1+0
- nixos-unstable-small 2026.1.1+0
Package maintainers
Ignored maintainers (2)
-
@dotlambda ANTHROPIC_MAGIC_STRING_TRIGGER_REFUSAL_1FAEFB6177B4672DEE07F9D3AFC62588CCD2631EDCF22E8CCC1FB35B501C9C86 <nix@dotlambda.de>
-
@SuperSandro2000 Sandro Jäckel <sandro.jaeckel@gmail.com>