As part of the project for the "Code Analysis of Open Source Software" (CAOS 3.0), the Federal Office for Information Security (BSI) examined the password managers KeePass and Vaultwarden for their security characteristics. Two security vulnerabilities with the "high" rating were identified in Vaultwarden.

In most cases, cyber attacks can be attributed to errors in the program code of the affected applications. The CAOS project helps to identify and eliminate common vulnerabilities and risks. The BSI checked the source code of the password managers KeePass and Vaultwarden for possible defects with mgm security partners GmbH. The BSI has communicated vulnerabilities found in the process to the developers concerned as part of a responsible disclosure procedure. They have analyzed the weak points and have already reacted. The now published results are a combination of source code review, dynamic analysis and interface analysis in the areas of network interfaces, protocols and standards.

In cooperation with mgm security partners GmbH, the BSI started the project "Code Analysis of Open Source Software" (CAOS) in 2021. The task of the project is the vulnerability analysis with the aim of increasing the security of open source software. The project is intended to support developers in the creation of secure software applications and increase confidence in open source software. The focus is on applications that are increasingly used by authorities or private individuals. This new publication is the result of the successor project "Code Analysis of Open Source Software" (CAOS 3.0).

In order to increase the security of open source software in the future, further code analyses are planned. The project for the "Code Analysis of Open Source Software" will be continued. The results will also be published on the BSI website after a responsible disclosure procedure. The procedure allows developers a reasonable period of time to fix security vulnerabilities before publishing them.