Advisoriesby IbisOpenBaoGHSA-2q8q-8fgw-9p6p
OpenBao LDAP MFA Enforcement Bypass When Using Username As Alias
Fix: upgrade to 0.0.0-20250807212521-c52795c1ef74 or later (2 fixed versions below)
Impact
OpenBao allows assignment of policies and MFA attribution based upon entity aliases, chosen by the underlying auth method. When using the username_as_alias=true parameter in the LDAP auth method, the caller-supplied username is used verbatim without normalization, allowing an attacker to bypass alias-specific MFA requirements.
Patches
OpenBao v2.3.2 will patch this issue.
Workarounds
LDAP methods are only vulnerable if using username_as_alias=true. Remove all usage of this parameter and update any entity aliases accordingly.
References
This issue was disclosed to HashiCorp and is the OpenBao equivalent of the following tickets:
- https://discuss.hashicorp.com/t/hcsec-2025-20-vault-ldap-mfa-enforcement-bypass-when-using-username-as-alias/76092
- https://nvd.nist.gov/vuln/detail/CVE-2025-6013
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| github.com/openbao/openbao Go | >= 0.1.0, < 2.3.2 | 2.3.2 |
| < 0.0.0-20250807212521-c52795c1ef74 | 0.0.0-20250807212521-c52795c1ef74 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-156
- Also known as
- BIT-openbao-2025-55001, CVE-2025-55001, GO-2025-3859
- github.com/openbao/openbao/security/advisories/GHSA-2q8q-8fgw-9p6p
- nvd.nist.gov/vuln/detail/CVE-2025-55001
- nvd.nist.gov/vuln/detail/CVE-2025-6013
- github.com/openbao/openbao/commit/c52795c1ef746c7f2c510f9225aa8ccbbd44f9fc
- discuss.hashicorp.com/t/hcsec-2025-20-vault-ldap-mfa-enforcement-bypass-when-using-username-as-alias/76092
- github.com/openbao/openbao
More OpenBao advisories
All OpenBao
OpenBao Login MFA Bypass of Rate Limiting and TOTP Token ReuseCVE-2025-55003fixed in 0.0.0-20250807113757-8340a6918f6c +1OpenBao TOTP Secrets Engine Code ReuseCVE-2025-55000fixed in 0.0.0-20250806193153-183891f8d535 +1OpenBao has a Timing Side-Channel in the Userpass Auth MethodCVE-2025-54999fixed in 0.0.0-20250806193356-4d9b5d3d6486 +1OpenBao Userpass and LDAP User Lockout BypassCVE-2025-54998fixed in 0.0.0-20250807212521-c52795c1ef74 +1Privileged OpenBao Operator May Execute Code on the Underlying HostCVE-2025-54997fixed in 0.0.0-20250806194004-a14053c9679d +1OpenBao Root Namespace Operator May Elevate Token PrivilegesCVE-2025-54996fixed in 0.0.0-20250806193240-9b0b5d4f345f +1