25 Zero-Knowledge Bypass Vulnerabilities in Cloud Password Managers (Bitwarden/LastPass/Dashlane) — ETH Zurich Research, Key Escrow, AES-CBC Malleability, KDF Downgrade (300Kx Brute-Force), Unauthenticated Public Keys, 60M+ Users — Threadlinqs Intelligence
As of 2026-05-30, 25 Zero-Knowledge Bypass Vulnerabilities in Cloud Password Managers (Bitwarden/LastPass/Dashlane) — ETH Zurich Research, Key Escrow, AES-CBC Malleability, KDF Downgrade (300Kx Brute-Force), Unauthenticated Public Keys, 60M+ Users is a high-severity vulnerability threat attributed to a Switzerland-nexus actor, tracked by Threadlinqs Intelligence with 12 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 26 indicators of compromise.
Threat ID: TL-2026-0122 · Severity: HIGH · Status: MONITORING · Category: VULNERABILITY
Attribution: Switzerland · research
ETH Zurich researchers discovered 25 vulnerabilities across Bitwarden (12), LastPass (7), and Dashlane (6) that bypass zero-knowledge encryption claims, enabling malicious servers to access, modify,
Researchers from ETH Zurich's Applied Cryptography Group (Matilda Backendal, Matteo Scarlata, Kenneth Paterson, Giovanni Torrisi) systematically audited the cryptographic architectures of three leading cloud-based password managers — Bitwarden, LastPass, and Dashlane — which collectively serve over 60 million users with a 23% combined market share. Under a fully malicious server threat model (server deviates arbitrarily from expected protocols), they demonstrated 25 attacks that bypass the 'zero-knowledge encryption' claims all three vendors advertise.
The 25 vulnerabilities span four attack categories:
**1. Key Escrow Attacks (BW01-BW03, LP01) — Full Vault Compromise:**
These target account recovery and SSO login mechanisms. Bitwarden's BW01 allows malicious auto-enrollment where unauthenticated organization public keys enable key substitution and full vault compromise upon joining any group — requiring just 1 join interaction. BW02 exploits key rotation for full vault compromise (1 rotation). BW03 uses KC conversion dialog for key substitution (1 dialog). LastPass LP01 exploits password reset flaws for full vault compromise (1 login). These are the most severe: a compromised server can replace encryption keys during routine operations, gaining complete access to all stored credentials.
**2. Item-Level Encryption Flaws (BW04-BW07, LP02-LP06, DL01) — Integrity Violations, Metadata Leaks, KDF Downgrades:**
Per-item encryption implementations contain critical weaknesses. BW04 exposes unprotected metadata (no client interaction needed). BW05 enables field/item swapping due to lack of key separation. BW06 leaks confidentiality through icon URL decryption (1 open). BW07 removes brute-force protection via KDF iteration downgrade (1 login) — accelerating brute-force by up to 300,000x. LastPass LP02 enables field swapping, LP03 leaks confidentiality via icon URLs (1 open), LP04 downgrades KDF (1 login), LP05 compromises vault integrity via AES-CBC malleability, LP06 allows metadata read/modification. Dashlane DL01 enables transaction replay due to shared keys across transactions. Root causes: lack of authenticated encryption (AES-CBC without integrity), missing key separation between item types, and unprotected metadata.
**3. Sharing Feature Exploits (BW08-BW09, LP07, DL02) — Organization/Team Compromise:**
Unauthenticated public keys in sharing features enable organization-wide attacks. BW08 allows adding users to organizations (1 sync). BW09 enables full organization compromise via key substitution (1 join). LP07 allows shared vault compromise (1 join). DL02 overwrites sharing keys upon joining (1 join). The fundamental flaw: public keys used for vault sharing are not authenticated, allowing a malicious server to inject attacker-controlled keys.
**4. Backwards Compatibility Issues (BW10-BW12, DL03-DL06) — CBC Downgrades:**
Legacy code support enables downgrade attacks to insecure AES-CBC mode. BW10 downgrades key hierarchy. BW11 causes confidentiality loss (2 logins). BW12 achieves full vault compromise via CBC support (2 logins). DL03 compromises vault integrity (10^4 syncs). DL04 removes brute-force protection (10^4 syncs). DL05 causes confidentiality loss (10^5 syncs). DL06 removes brute-force protection (10^4 syncs) — the 'Lucky 64' attack. Root cause: maintaining backwards compatibility with cryptographic technologies from the 1990s to avoid customer data loss risks.
Disclosure followed responsible timelines: Bitwarden notified January 27, 2025; LastPass June 4, 2025; Dashlane August 29, 2025 — all with 90-day remediation windows. Bitwarden advanced fixes including minimum KDF iterations and CBC removal. LastPass addressed LP03. Dashlane mitigated some CBC issues via extension 6.2544.1. However, not all vulnerabilities have been patched across all vendors.
The researchers recommend four fundamental mitigations: Authenticated Encryption (AE) to replace AES-CBC, Full Key Separation (KS) between item types, Public Key Authe
Weaknesses (CWE)
CWE-327, CWE-347, CWE-328, CWE-326, CWE-757, CWE-345
Target sectors: technology, cloud-services, enterprise
Target regions: Global
Detections & IOCs
As of 2026-07-28, this threat has 12 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 26 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, HIGH, threat intelligence, cybersecurity, T1555, T1555.005, T1110, T1556, T1600, T1600.001, T1553, T1213, T1005, T1565.001