Researchers from ETH Zurich have uncovered 25 serious vulnerabilities in three leading cloud-based password managers<\/a>: Bitwarden, LastPass, and Dashlane.<\/p>\n These flaws enable a malicious server to bypass zero-knowledge encryption claims, allowing unauthorized access, modification, and recovery of users\u2019 stored passwords and vault data.<\/p>\n Bitwarden, LastPass, and Dashlane collectively serve over 60 million users and hold significant market share. The analysis targets their client-server interactions under a fully malicious server threat model, where servers deviate arbitrarily from protocols.<\/p>\n Vendors advertise \u201czero-knowledge encryption,\u201d implying servers cannot access plaintext vaults even if compromised, but the researchers demonstrate repeated failures in confidentiality and integrity protections.<\/p>\n The 25 attacks span four categories: key escrow mechanisms, item-level vault encryption flaws, sharing features, and backwards compatibility issues.<\/p>\n Key Escrow Attacks<\/strong><\/p>\n These target account recovery and SSO login mechanisms enable full vault compromise via unauthenticated keys. Bitwarden\u2019s BW01-BW03 allow malicious auto-enrollment, key rotation, and KC conversion through key substitution upon joining organizations or dialogs. LastPass\u2019s LP01 exploits password reset flaws similarly.<\/p>\n Item-Level Encryption Flaws<\/strong><\/p>\n Flawed per-item encryption leads to integrity violations, metadata leaks, field swapping, and KDF downgrades. Bitwarden\u2019s BW04-BW07 expose unprotected metadata, swap fields, decrypt icons, and remove iterations for brute-force. LastPass LP02-LP06 and Dashlane DL01 enable malleable vaults and replay attacks due to AES-CBC and missing bindings.<\/p>\n Sharing Feature Exploits<\/strong><\/p>\n Unauthenticated public keys compromise organizations and shared vaults. Bitwarden\u2019s BW08-BW09 inject or overwrite organizations; LastPass LP07 and Dashlane DL02 overwrite sharing keys upon joining. Impacts scale to team-wide access.<\/p>\n Backwards Compatibility Issues<\/strong><\/p>\n Legacy code support triggers downgrades to insecure modes like CBC. Bitwarden\u2019s BW10-BW12 disable protections and overwrite keys; Dashlane\u2019s DL03-DL06 enable injections, KDF removal, and \u201cLucky 64\u201d after syncs. Dashlane patched via extension 6.2544.1.<\/p>\n In Bitwarden, 12 attacks include malicious auto-enrollment (BW01), where unauthenticated organization public keys allow key substitution and full vault compromise upon joining any group.<\/p>\n LastPass faces seven issues, such as lacking ciphertext integrity with AES-CBC (LP05), enabling malleable vaults, and field swapping. Dashlane has six vulnerabilities, like transaction replay (DL01) due to shared keys across transactions, violating vault integrity.<\/p>\n Many attacks require minimal interaction, like a single login or sync, exploiting unauthenticated public keys, missing key separation, and legacy AES-CBC support. For instance, icon URL decryption leaks (BW06, LP03) reveal passwords via client requests. KDF iteration downgrades (BW07, LP04) accelerate brute-force by up to 300,000x.<\/p>\n Researchers disclosed findings responsibly<\/a>: Bitwarden on January 27, 2025; LastPass on June 4, 2025; Dashlane on August 29, 2025, with 90-day remediation windows.<\/p>\n Bitwarden advanced fixes for several, including minimum KDF iterations and CBC removal; LastPass addressed LP03; Dashlane mitigated some CBC issues. Recommended mitigations include authenticated encryption (AE), full key separation (KS), public key authentication (PKA), and ciphertext signing (SC).<\/p>\n Users should update clients, enable per-item keys where available, and monitor vendor patches. The study urges formal security models for password managers akin to E2EE cloud storage. Self-hosted deployments remain vulnerable if servers are compromised.<\/p>\n Follow us on Google News<\/a>, LinkedIn<\/a>, and X<\/a> for daily cybersecurity updates. Contact us<\/a> to feature your stories.<\/strong><\/p>\n The post 25 Vulnerabilities in Cloud Password Managers Allow Unauthorized Access and Modifications<\/a> appeared first on Cyber Security News<\/a>.<\/p>\n<\/div>\n\n\n
\n \nAttack Ref<\/th>\n Product<\/th>\n Cause<\/th>\n Impact<\/th>\n Client Interaction<\/th>\n<\/tr>\n<\/thead>\n \n BW01<\/td>\n Bitwarden<\/td>\n Lack of Key Auth, Key Substitution<\/td>\n Full vault compromise<\/td>\n 1 join<\/td>\n<\/tr>\n \n BW02<\/td>\n Bitwarden<\/td>\n Key Substitution<\/td>\n Full vault compromise<\/td>\n 1 rotation<\/td>\n<\/tr>\n \n BW03<\/td>\n Bitwarden<\/td>\n Lack of Key Auth, Key Substitution<\/td>\n Full vault compromise<\/td>\n 1 dialog<\/td>\n<\/tr>\n \n LP01<\/td>\n LastPass<\/td>\n Lack of Key Auth<\/td>\n Full vault compromise<\/td>\n 1 login<\/td>\n<\/tr>\n \n BW04<\/td>\n Bitwarden<\/td>\n Lack of Auth Enc<\/td>\n Read\/modify metadata<\/td>\n \u2013<\/td>\n<\/tr>\n \n BW05<\/td>\n Bitwarden<\/td>\n Lack of Key Sep<\/td>\n Field\/item swapping<\/td>\n \u2013<\/td>\n<\/tr>\n \n BW06<\/td>\n Bitwarden<\/td>\n Lack of Key Sep<\/td>\n Loss of confidentiality<\/td>\n 1 open<\/td>\n<\/tr>\n \n BW07<\/td>\n Bitwarden<\/td>\n Lack of Auth Enc<\/td>\n No brute-force protection<\/td>\n 1 login<\/td>\n<\/tr>\n \n LP02<\/td>\n LastPass<\/td>\n Lack of Auth Enc<\/td>\n Field\/item swapping<\/td>\n \u2013<\/td>\n<\/tr>\n \n LP03<\/td>\n LastPass<\/td>\n Lack of Key Sep<\/td>\n Loss of confidentiality<\/td>\n 1 open<\/td>\n<\/tr>\n \n LP04<\/td>\n LastPass<\/td>\n Lack of Auth Enc<\/td>\n No brute-force protection<\/td>\n 1 login<\/td>\n<\/tr>\n \n LP05<\/td>\n LastPass<\/td>\n Lack of Auth Enc<\/td>\n Loss of vault integrity<\/td>\n \u2013<\/td>\n<\/tr>\n \n DL01<\/td>\n Dashlane<\/td>\n Lack of Key Sep<\/td>\n Loss of vault integrity<\/td>\n \u2013<\/td>\n<\/tr>\n \n BW08<\/td>\n Bitwarden<\/td>\n Lack of Key Auth<\/td>\n Add users to orgs<\/td>\n 1 sync<\/td>\n<\/tr>\n \n BW09<\/td>\n Bitwarden<\/td>\n Lack of Key Auth, Key Substitution<\/td>\n Org compromise<\/td>\n 1 join<\/td>\n<\/tr>\n \n LP07<\/td>\n LastPass<\/td>\n Lack of Key Auth<\/td>\n Shared vault compromise<\/td>\n 1 join<\/td>\n<\/tr>\n \n DL02<\/td>\n Dashlane<\/td>\n Lack of Key Auth<\/td>\n Shared vault compromise<\/td>\n 1 join<\/td>\n<\/tr>\n \n BW10<\/td>\n Bitwarden<\/td>\n Lack of Auth Enc<\/td>\n Downgrade key hierarchy<\/td>\n \u2013<\/td>\n<\/tr>\n \n BW11<\/td>\n Bitwarden<\/td>\n CBC Support<\/td>\n Loss of confidentiality<\/td>\n 2 logins<\/td>\n<\/tr>\n \n BW12<\/td>\n Bitwarden<\/td>\n CBC Support<\/td>\n Full vault compromise<\/td>\n 2 logins<\/td>\n<\/tr>\n \n DL03<\/td>\n Dashlane<\/td>\n CBC Support<\/td>\n Loss of vault integrity<\/td>\n 104 syncs<\/td>\n<\/tr>\n \n DL04<\/td>\n Dashlane<\/td>\n CBC Support<\/td>\n No brute-force protection<\/td>\n 104 syncs<\/td>\n<\/tr>\n \n DL05<\/td>\n Dashlane<\/td>\n CBC Support<\/td>\n Loss of confidentiality<\/td>\n 105 syncs<\/td>\n<\/tr>\n \n DL06<\/td>\n Dashlane<\/td>\n CBC Support<\/td>\n No brute-force protection<\/td>\n 104 syncs<\/td>\n<\/tr>\n \n LP06<\/td>\n LastPass<\/td>\n Lack of Auth Enc<\/td>\n Read\/modify metadata<\/td>\n \u2013<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/figure>\n ![\"Attack](\"https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEh8o0AmE7oBpKBOpxHyx7uyGZelLx1XRrbrY7baJ3Hl_VBKNmnxHQbLjHA5fZtrYSabi5Qx4oQyka8XKhqIIeMHYmQbycRav2qk6uvsDj8dCGhgGzcxHZUbgT2FDgdjfGnT-rFECRlOKCzHbRdCBGhk6KiGLAp2XPjICLpbL_nMfSPQmfTQXctfDs-s8DC-\/s16000\/hierarchies.webp?ssl=1\")