PT-2025-31680 · Hashicorp+1 · Vault Enterprise+2

Yarden Porat · Published 2025-08-01 · Updated 2025-09-05 · CVE-2025-6015

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Vault versions prior to 1.20.1 Vault Enterprise versions prior to 1.20.1, 1.19.7, 1.18.12, and 1.16.23

Description Vault and Vault Enterprise’s login MFA rate limits could be bypassed, and TOTP tokens could be reused.

Recommendations Update Vault to version 1.20.1 or later. Update Vault Enterprise to version 1.20.1, 1.19.7, 1.18.12, or 1.16.23 or later.

Fix

Improper Authentication

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-287

CWE-307

Related Identifiers

BDU:2025-11260

BIT-VAULT-2025-6015

CVE-2025-6015

GHSA-RXP7-9Q75-VJ3P

GHSA-V6R4-35F9-9RPW

GO-2025-3842

GO-2025-3856

OPENSUSE-SU-2025:15434-1

OPENSUSE-SU-2025:15460-1

SUSE-SU-2025:02912-1

Affected Products

Red Os

Vault

Vault Enterprise

References · 54

• https://osv.dev/vulnerability/GHSA-v6r4-35f9-9rpw · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rxp7-9q75-vj3p · Vendor Advisory
• https://discuss.hashicorp.com/t/hcsec-2025-19-vault-login-mfa-bypass-of-rate-limiting-and-totp-token-reuse/76038 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:02912-1 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-vault-2025-6015 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-6015 · Security Note
• https://osv.dev/vulnerability/CVE-2025-6015 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-55003 · Security Note
• https://osv.dev/vulnerability/GO-2025-3856 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15434-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-11260 · Security Note
• https://osv.dev/vulnerability/GO-2025-3842 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15460-1 · Vendor Advisory
• https://github.com/hashicorp/vault · Note
• https://github.com/openbao/openbao · Note