https://help.coinbase.com/en/coinbase/managing-my-account/other/the-multisig-vaultCoinbase multisig vault is 2 of 3 multi-signature wallet.
One of the keys is owned only by the user. One of them is stored by coinbase and the user has no access to that. One of the keys (which is encrypted) is owned by both coinbase and user.
If you own two of the keys, you must be able to spend your fund without relying on Coinbase and without any need to 2FA or email verification.
It's weird I didn't receive any update about the vault and they never gave me any keys when I set up my vault. My vault was created in 2015 with 2FA and a secondary email they didn't send me any keys for recovery only the primary and secondary email is my backup to recover my vault.
This is weird and now they do have vault recovery on Github that asks for Coinbase, shared, and user xpub keys.
@OP I don't think it would ask for a password because mine only asks for a 2FA code when withdrawing after entering the 2FA it will ask if you gonna approve the transaction or not and then the 2nd email will receive a link to approve the transaction.
Or check this video below how to withdraw from the vault
-
https://youtu.be/hM4o-TThT28?si=vHRcWP0sL32y_xcb