Vulnerability Disclosure: Authentication Bypass in Vaultwarden versions < 1.32.5
Vulnerability Disclosure: Authentication Bypass in Vaultwarden versions < 1.32.5
Please update Vaultwarden as soon as possible if you did not do it yet.
The blog post contains an interesting tineline. Apparently, the first fix was not sufficient. So if you have updated Vaultwaren before November 18, update it again.
Copy of the timeline:
Hopefully, it was previously announced to update as soon as possible before disclosing the vulnerabilty. Good job by security experts and Vaultwarden team!
Yes it was, the release notes explicitly specify it for 1.32.4 and 1.32.5
Am I understanding correctly that if users had 2FA, the vulnerability would be prevented from gaining access?
Correct. Only users without 2fa were in danger.