25 Zero-Knowledge Bypass Vulnerabilities in Cloud Password Managers (Bitwarden/LastPass/Dashlane) — ETH Zurich Research, Key Escrow, AES-CBC Malleability, KDF Downgrade (300Kx Brute-Force), Unauthenticated Public Keys, 60M+ Users
25 Zero-Knowledge Bypass Vulnerabilities in Cloud Password (TL-2026-0122) is a high-severity software vulnerability, first published 2026-02-17. It carries a reported Switzerland nexus and is not formally attributed, maps to 19 MITRE ATT&CK techniques (T1005, T1087, T1098), and is covered by 12 detection rules and 26 indicators of compromise.
Key facts for TL-2026-0122
- Threat ID
- TL-2026-0122
- Severity
- HIGH
- Status
- MONITORING
- Category
- VULNERABILITY
- First published
- 2026-02-17
- Last reviewed
- 2026-02-17
- Attribution confidence
- NONE
- Nation-state nexus
- Switzerland
- Motivation
- research
- Target sectors
- technology, cloud-services, enterprise
- Target regions
- Global
- Detection rules
- 12
- Indicators of compromise
- 26
ETH Zurich researchers discovered 25 vulnerabilities across Bitwarden (12), LastPass (7), and Dashlane (6) that bypass zero-knowledge encryption claims, enabling malicious servers to access, modify, and recover plaintext vault data for 60M+ users.
How 25 Zero-Knowledge Bypass Vulnerabilities in Cloud Password works
Researchers from ETH Zurich's Applied Cryptography Group (Matilda Backendal, Matteo Scarlata, Kenneth Paterson, Giovanni Torrisi) systematically audited the cryptographic architectures of three leading cloud-based password managers — Bitwarden, LastPass, and Dashlane — which collectively serve over 60 million users with a 23% combined market share. Under a fully malicious server threat model (server deviates arbitrarily from expected protocols), they demonstrated 25 attacks that bypass the 'zero-knowledge encryption' claims all three vendors advertise.
The 25 vulnerabilities span four attack categories:
**1. Key Escrow Attacks (BW01-BW03, LP01) — Full Vault Compromise:** These target account recovery and SSO login mechanisms. Bitwarden's BW01 allows malicious auto-enrollment where unauthenticated organization public keys enable key substitution and full vault compromise upon joining any group — requiring just 1 join interaction. BW02 exploits key rotation for full vault compromise (1 rotation). BW03 uses KC conversion dialog for key substitution (1 dialog). LastPass LP01 exploits password reset flaws for full vault compromise (1 login). These are the most severe: a compromised server can replace encryption keys during routine operations, gaining complete access to all stored credentials.
**2. Item-Level Encryption Flaws (BW04-BW07, LP02-LP06, DL01) — Integrity Violations, Metadata Leaks, KDF Downgrades:** Per-item encryption implementations contain critical weaknesses. BW04 exposes unprotected metadata (no client interaction needed). BW05 enables field/item swapping due to lack of key separation. BW06 leaks confidentiality through icon URL decryption (1 open). BW07 removes brute-force protection via KDF iteration downgrade (1 login) — accelerating brute-force by up to 300,000x. LastPass LP02 enables field swapping, LP03 leaks confidentiality via icon URLs (1 open), LP04 downgrades KDF (1 login), LP05 compromises vault integrity via AES-CBC malleability, LP06 allows metadata read/modification. Dashlane DL01 enables transaction replay due to shared keys across transactions. Root causes: lack of authenticated encryption (AES-CBC without integrity), missing key separation between item types, and unprotected metadata.
**3. Sharing Feature Exploits (BW08-BW09, LP07, DL02) — Organization/Team Compromise:** Unauthenticated public keys in sharing features enable organization-wide attacks. BW08 allows adding users to organizations (1 sync). BW09 enables full organization compromise via key substitution (1 join). LP07 allows shared vault compromise (1 join). DL02 overwrites sharing keys upon joining (1 join). The fundamental flaw: public keys used for vault sharing are not authenticated, allowing a malicious server to inject attacker-controlled keys.
**4. Backwards Compatibility Issues (BW10-BW12, DL03-DL06) — CBC Downgrades:** Legacy code support enables downgrade attacks to insecure AES-CBC mode. BW10 downgrades key hierarchy. BW11 causes confidentiality loss (2 logins). BW12 achieves full vault compromise via CBC support (2 logins). DL03 compromises vault integrity (10^4 syncs). DL04 removes brute-force protection (10^4 syncs). DL05 causes confidentiality loss (10^5 syncs). DL06 removes brute-force protection (10^4 syncs) — the 'Lucky 64' attack. Root cause: maintaining backwards compatibility with cryptographic technologies from the 1990s to avoid customer data loss risks.
Disclosure followed responsible timelines: Bitwarden notified January 27, 2025; LastPass June 4, 2025; Dashlane August 29, 2025 — all with 90-day remediation windows. Bitwarden advanced fixes including minimum KDF iterations and CBC removal. LastPass addressed LP03. Dashlane mitigated some CBC issues via extension 6.2544.1. However, not all vulnerabilities have been patched across all vendors.
The researchers recommend four fundamental mitigations: Authenticated Encryption (AE) to replace AES-CBC, Full Key Separation (KS) between item types, Public Key Authentication (PKA) for sharing features, and Ciphertext Signing (SC) for integrity. They advocate formal security models for password managers equivalent to those used for E2EE cloud storage. The ETH Zurich team noted providers' reluctance to update systems due to risk of customer data loss, resulting in continued use of obsolete 1990s-era cryptographic technologies.
MITRE ATT&CK techniques used in TL-2026-0122
collection
T1005 Data from Local System; T1213 Data from Information Repositories
discovery
persistence
credential-access
T1110 Brute Force; T1110.001 Password Guessing; T1555 Credentials from Password Stores; T1555.005 Password Managers; T1556 Modify Authentication Process; T1649 Steal or Forge Authentication Certificates
initial-access
impact
T1531 Account Access Removal; T1565.001 Stored Data Manipulation
defense-evasion
T1550 Use Alternate Authentication Material
defense-impairment
T1553 Subvert Trust Controls; T1600 Weaken Encryption; T1600.001 Reduce Key Space; T1689 Downgrade Attack
resource-development
Remediation for 25 Zero-Knowledge Bypass Vulnerabilities in Cloud Password
Patches
- Bitwarden: Minimum KDF iterations enforced, CBC removal in progress (Jan 2025 disclosure)
- LastPass: LP03 (icon URL leak) addressed (Jun 2025 disclosure)
- Dashlane: Extension 6.2544.1 mitigates some CBC issues (Aug 2025 disclosure)
Immediate actions
- Update all password manager clients to latest versions immediately
- Enable per-item encryption keys where available (Bitwarden organizations)
- Review and rotate critical stored credentials (banking, email, admin accounts)
- Enable MFA on all password manager accounts to reduce key escrow risk
- Avoid using organization/sharing features until vendor confirms PKA implementation
- Monitor vendor security bulletins for patch availability
Workarounds
- Use strong, unique master passwords (20+ characters) to resist KDF downgrade brute-force attacks
- Disable automatic organization enrollment features where possible
- Avoid sharing vaults until vendors confirm public key authentication
- Regularly export and verify vault contents for integrity
- Consider offline/local-only password managers for highest-sensitivity credentials
Longer-term hardening
- Implement Authenticated Encryption (AE) to replace AES-CBC across all vault operations
- Deploy Full Key Separation (KS) — distinct keys for different item types and metadata
- Authenticate all public keys (PKA) in sharing and organization features
- Add Ciphertext Signing (SC) for vault integrity verification
- Develop formal security models for password managers equivalent to E2EE cloud storage
- Consider self-hosted deployments for highest-sensitivity credentials (noting server compromise still applies)
- Evaluate migration to password managers with strongest post-disclosure security posture
Weaknesses (CWE) in 25 Zero-Knowledge Bypass Vulnerabilities in Cloud Password
CWE-327, CWE-347, CWE-328, CWE-326, CWE-757, CWE-345
Timeline of 25 Zero-Knowledge Bypass Vulnerabilities in Cloud Password
- ETH Zurich researchers disclose 12 vulnerabilities (BW01-BW12) to Bitwarden with 90-day remediation window. Bitwarden is first vendor notified. Source: https://ethz.ch/en/news-and-events/eth-news/news/2026/02/password-managers-less-secure-than-promised.html
- ETH Zurich researchers disclose 7 vulnerabilities (LP01-LP07) to LastPass with 90-day remediation window. Source: https://cybersecuritynews.com/password-managers-vulnerability/
- ETH Zurich researchers disclose 6 vulnerabilities (DL01-DL06) to Dashlane with 90-day remediation window. Dashlane is last vendor notified. Source: https://cybersecuritynews.com/password-managers-vulnerability/
- Dashlane releases extension 6.2544.1 mitigating some CBC backward compatibility issues (DL03-DL06). Source: https://cybersecuritynews.com/password-managers-vulnerability/
- LastPass addresses LP03 (icon URL confidentiality leak). Status of other 6 vulnerabilities (LP01, LP02, LP04-LP07) unclear. Source: https://cybersecuritynews.com/password-managers-vulnerability/
- Bitwarden implements partial fixes: minimum KDF iterations enforced (addresses BW07 brute-force amplification) and begins CBC removal (addresses BW11-BW12). Not all 12 vulnerabilities fully patched. Source: https://cybersecuritynews.com/password-managers-vulnerability/
- ETH Zurich publicly discloses all 25 vulnerabilities. Research paper published. Media coverage confirms findings affect 60M+ users across 23% market share. Researchers note providers were 'not all as quick' to fix vulnerabilities. Source: https://ethz.ch/en/news-and-events/eth-news/news/2026/02/password-managers-less-secure-than-promised.html
- As of 2026-05-29, these 25 ETH Zurich-disclosed cryptographic design flaws in Bitwarden/LastPass/Dashlane have no in-the-wild exploitation, no CVEs and no CISA KEV listing, and require a malicious-server model with no attributable actor. Vendor remediation is partial and ongoing (Bitwarden 7 of 12 fixed/in-progress, Dashlane ext 6.2544.1, LastPass LP03 + hardening), so MONITORING fits better than a full PATCHED close.
Sources cited for 25 Zero-Knowledge Bypass Vulnerabilities in Cloud Password
More in vulnerability
- CVE-2025-59201: Windows Network Connection Status Indicator (NCSI) Elevation of Privilege via Registry Symbolic Link Abuse
- CVE-2026-20817: Windows Error Reporting Service (WerSvc.dll) Local Privilege Escalation via ALPC Argument Injection
- Sudo iptables NOPASSWD Misconfiguration Enables Local Privilege Escalation via Comment Injection
- CVE-2025-37947: Out-of-Bounds Write in Linux ksmbd Kernel SMB Server Enables Local Privilege Escalation
- Dell ObjectScale Critical Deserialization Flaw (CVE-2026-70416, CVSS 10.0) Enables Unauthenticated RCE
Detection coverage for TL-2026-0122
As of 2026-02-17, Threadlinqs Intelligence publishes 12 detection rule(s) for TL-2026-0122 across Splunk SPL, Microsoft KQL and Sigma, covering 26 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.