PT-2025-32152 · Hashicorp+1 · Vault Enterprise+2

Yarden Porat · Published 2025-08-06 · Updated 2026-05-24 · CVE-2025-6013

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions Vault versions prior to 1.20.2 Vault Enterprise versions prior to 1.20.2 Vault Enterprise version 1.19.8 Vault Enterprise version 1.18.13 Vault Enterprise version 1.16.24

Description The LDAP authentication method in Vault and Vault Enterprise may not have correctly enforced multi-factor authentication (MFA) when username as alias was set to true and a user had multiple Common Names (CNs) that were equal but contained leading or trailing spaces.

Recommendations Upgrade to Vault Community Edition version 1.20.2 or later. Upgrade to Vault Enterprise version 1.20.2 or later. Upgrade to Vault Enterprise version 1.19.8. Upgrade to Vault Enterprise version 1.18.13. Upgrade to Vault Enterprise version 1.16.24.

Fix

Weakness Enumeration

CWE-156

Related Identifiers

BDU:2025-09582

BIT-VAULT-2025-6013

CVE-2025-6013

GHSA-2Q8Q-8FGW-9P6P

GHSA-7RX2-769V-HRWF

GO-2025-3848

GO-2025-3859

OPENSUSE-SU-2025:15434-1

OPENSUSE-SU-2025:15460-1

SUSE-SU-2025:02912-1

Affected Products

Red Os

Vault

Vault Enterprise

References · 60

• https://discuss.hashicorp.com/t/hcsec-2025-20-vault-ldap-mfa-enforcement-bypass-when-using-username-as-alias/76092 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:02912-1 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-3859 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7rx2-769v-hrwf · Vendor Advisory
• https://osv.dev/vulnerability/BIT-vault-2025-6013 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2q8q-8fgw-9p6p · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-09582 · Security Note
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-6013 · Security Note
• https://osv.dev/vulnerability/GO-2025-3848 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-55001 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2025:15434-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-6013 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15460-1 · Vendor Advisory
• https://github.com/hashicorp/vault · Note