Name of the Vulnerable Software and Affected Versions:

Vault versions prior to 1.20.1

Vault Enterprise versions prior to 1.20.1

Vault Enterprise version 1.19.7

Vault Enterprise version 1.18.12

Vault Enterprise version 1.16.23

Description:

The Time-based One-Time Password (TOTP) Secrets Engine in Vault and Vault Enterprise is susceptible to code reuse within its validity period due to an issue with the code validation endpoint.

Recommendations:

Update Vault to version 1.20.1 or later.

Update Vault Enterprise to version 1.20.1 or later.

Update Vault Enterprise to version 1.19.7 or later.

Update Vault Enterprise to version 1.18.12 or later.

Update Vault Enterprise to version 1.16.23 or later.