In “Bitwarden/web”, v1.6.0 to v1.9.1 do not properly implement a defense against timing attacks on mac verification. This allows a remote attacker to guess the correct bytes of the tag by looping over all possible first bytes and stop when verification takes a little longer, by repeating this process for all tag bytes an attacker will obtain a valid tag.