PT-2025-32384 · Openbao+1 · Openbao+1

Cipherboy · Published 2025-08-08 · Updated 2025-09-12 · CVE-2025-55003

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenBao versions 2.3.1 and below

Description OpenBao’s Login Multi-Factor Authentication (MFA) system, utilizing Time-based One Time Password (TOTP), accepted codes containing whitespace due to normalization applied by the underlying TOTP library. This bypassed internal rate limiting, allowing reuse of existing MFA codes.

Recommendations Upgrade to version 2.3.2 to resolve this issue. Utilize rate-limiting quotas to limit potential exploitation.

Exploit

Fix

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-307

Related Identifiers

BDU:2025-11278

CVE-2025-55003

GHSA-RXP7-9Q75-VJ3P

GO-2025-3856

OPENSUSE-SU-2025:15434-1

OPENSUSE-SU-2025:15460-1

SUSE-SU-2025:02912-1

Affected Products

Openbao

Red Os

References · 52

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/55xxx/CVE-2025-55003.json · Exploit
• https://github.com/openbao/openbao/commit/8340a6918f6c41d8f75b6c3845c376d9dc32ed19 · Patch
• https://github.com/openbao/openbao/security/advisories/GHSA-rxp7-9q75-vj3p · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rxp7-9q75-vj3p · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:02912-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-11278 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-6015 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-55003 · Security Note
• https://osv.dev/vulnerability/GO-2025-3856 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-55003 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15434-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15460-1 · Vendor Advisory
• https://github.com/openbao/openbao · Note
• https://suse.com/security/cve/CVE-2025-53942 · Note
• https://suse.com/security/cve/CVE-2021-21411 · Note