# CVE-2026-31835: Vaultwarden WebAuthn backup flag tampering in validate_webauthn_login

Source: https://junglewise.ai/threats/cve-2026-31835-vaultwarden-webauthn-backup-flag-tampering-in-validate-webauthn  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-05. Updated: 2026-07-25  
License: CC BY 4.0 with a link back

CVE-2026-31835 · Severity: medium · CVSS 5.4 · Published 2026-05-05

Vaultwarden, an open-source password management server, contains a flaw in how it handles multi-factor authentication (MFA) using security keys. An attacker who has already stolen a user's password can send a malicious request that permanently corrupts the user's security key settings on the server. This results in a persistent lockout or denial of service for that specific MFA method, potentially preventing the legitimate user from accessing their vault or recovery options.

Technologies: [Dani-Garcia Vaultwarden](https://junglewise.ai/threats/technologies/vaultwarden). Vendors: [Dani-Garcia](https://junglewise.ai/threats/vendors/dani-garcia).

## Quick answers

**Is CVE-2026-31835 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-31835 being exploited in the wild.

**How severe is CVE-2026-31835?** Medium severity, with a CVSS score of 5.4, published 5 May 2026.

**Which products and versions are affected?** dani-garcia Vaultwarden <= 1.35.4.

**Is there a fix for CVE-2026-31835?** A patch was published on 2026-04-12: Version 1.35.5 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-31835 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-31835?** Check whether you run Dani-Garcia Vaultwarden. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability exists in the `validate_webauthn_login()` function of Vaultwarden where persistent credential metadata (`backup_eligible` and `backup_state` flags) is updated based on unverified `authenticatorData`. The root cause is that `check_and_update_backup_eligible()` is called and persists changes to the database before `finish_passkey_authentication()` performs signature validation. If the signature check subsequently fails, the database transaction is not rolled back. An attacker with valid primary credentials (password) can exploit this by submitting a tampered WebAuthn assertion to permanently modify stored backup flags, leading to a persistent denial of service for WebAuthn 2FA. This issue is fixed in version 1.35.5.

## Affected products

- dani-garcia Vaultwarden <= 1.35.4

## Timeline

- 2026-04-12: patched: Version 1.35.5 released
- 2026-04-25: advisory: GitHub Security Advisory GHSA-x7g7-cgx5-jhx2 published
- 2026-05-05: disclosed: CVE-2026-31835 published to NVD

## References

- [https://github.com/dani-garcia/vaultwarden/releases/tag/1.35.5](https://github.com/dani-garcia/vaultwarden/releases/tag/1.35.5)
- [https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-x7g7-cgx5-jhx2](https://github.com/dani-garcia/vaultwarden/security/advisories/GHSA-x7g7-cgx5-jhx2)

## Related threats

- [Vaultwarden authorization bypass in cipher access queries](https://junglewise.ai/threats/cve-2026-95814-vaultwarden-through-1-37-3-omits-organization-membership-status)
- [Vaultwarden account takeover via unverified SSO email linking](https://junglewise.ai/threats/cve-2026-47164-vaultwarden-account-takeover-via-unverified-sso-email-linking)
- [Vaultwarden information disclosure in SSO discovery flow](https://junglewise.ai/threats/cve-2026-47159-vaultwarden-information-disclosure-in-sso-discovery-flow)
- [Vaultwarden incorrect authorization in organization vault purge](https://junglewise.ai/threats/cve-2026-43913-vaultwarden-incorrect-authorization-in-organization-vault-purge)
- [Vaultwarden improper authorization in cross-org group binding](https://junglewise.ai/threats/cve-2026-43912-vaultwarden-improper-authorization-in-cross-org-group-binding)