PT-2025-32381 · Openbao+1 · Openbao+1

Cipherboy · Published 2025-08-08 · Updated 2025-09-12 · CVE-2025-54999

Positive Technologies (AI Summary)

CVSS v3.1

3.7

Low

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenBao versions 0.1.0 through 2.3.1

Description OpenBao is a software solution designed for managing, storing, and distributing sensitive data, including secrets, certificates, and keys. In versions 0.1.0 through 2.3.1, user enumeration was possible when using the userpass authentication method due to timing differences between non-existent users and users with stored credentials. This issue occurred regardless of the validity of the supplied credentials.

Recommendations OpenBao version 2.3.2 and later resolves this issue. As a workaround, use an alternative authentication method. Apply rate limiting quotas to limit the number of requests within a specific timeframe.

Exploit

Fix

Side Channel Attack

Weakness Enumeration

CWE-203

Related Identifiers

BDU:2025-11277

CVE-2025-54999

GHSA-HH28-H22F-8357

GO-2025-3854

OPENSUSE-SU-2025:15434-1

SUSE-SU-2025:02912-1

Affected Products

Openbao

Red Os

References · 52

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54999.json · Exploit
• https://github.com/openbao/openbao/commit/4d9b5d3d6486ab9fbd5b644173fa0097015d6626 · Patch
• https://github.com/openbao/openbao/security/advisories/GHSA-hh28-h22f-8357 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-6011 · Security Note
• https://osv.dev/vulnerability/CVE-2025-54999 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:02912-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-54999 · Security Note
• https://bdu.fstec.ru/vul/2025-11277 · Security Note
• https://osv.dev/vulnerability/GHSA-hh28-h22f-8357 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15434-1 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-3854 · Vendor Advisory
• https://github.com/openbao/openbao · Note
• https://discuss.hashicorp.com/t/hcsec-2025-21-vault-user-enumeration-in-userpass-auth-method/76095 · Note
• https://redos.red-soft.ru/support/secure · Note
• https://suse.com/security/cve/CVE-2025-53942 · Note