OpenBao TOTP Secrets Engine Code Reuse
Medium6.5CVE-2025-55000 · Published Aug 8, 2025 · updated Jul 27, 2026
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| github.com/openbao/openbao Go | >= 0.1.0, < 2.3.2 | 2.3.2 |
| < 0.0.0-20250806193153-183891f8d535 | 0.0.0-20250806193153-183891f8d535 |
Details and references
### Impact OpenBao's TOTP secrets engine could accept valid codes multiple times rather than strictly-once. This was caused by unexpected normalization in the underlying TOTP library. ### Patches OpenBao v2.3.2 will patch this issue. In patching, codes which were not normalized (strictly N numeric digits) will now be rejected. This is a potentially breaking change. ### Workarounds TOTP code verification is a privileged action; only trusted systems should be verifying codes. Ensure that all codes are first normalized before submitting to the OpenBao endpoint. ### References This issue was disclosed to HashiCorp and is the OpenBao equivalent of the following tickets: - https://discuss.hashicorp.com/t/hcsec-2025-17-vault-totp-secrets-engine-code-reuse/76036 - https://nvd.nist.gov/vuln/detail/CVE-2025-6014
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-156
- Also known as
- BIT-openbao-2025-55000, CVE-2025-55000, GO-2025-3853
- github.com/openbao/openbao/security/advisories/GHSA-f7c3-mhj2-9pvg
- nvd.nist.gov/vuln/detail/CVE-2025-55000
- nvd.nist.gov/vuln/detail/CVE-2025-6014
- github.com/openbao/openbao/commit/183891f8d535d5b6eb3d79fda8200cade6de99e1
- discuss.hashicorp.com/t/hcsec-2025-17-vault-totp-secrets-engine-code-reuse/76036
- github.com/openbao/openbao
More openbao advisories
All| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Aug 82025 | OpenBao Root Namespace Operator May Elevate Token Privileges CVE-2025-54996High7.2fixed in 0.0.0-20250806193240-9b0b5d4f345f, 2.3.2 | High7.2 | 0.0.0-20250806193240-9b0b5d4f345f, 2.3.2 |
| Aug 82025 | Privileged OpenBao Operator May Execute Code on the Underlying Host CVE-2025-54997Critical9.1fixed in 0.0.0-20250806194004-a14053c9679d, 2.3.2 | Critical9.1 | 0.0.0-20250806194004-a14053c9679d, 2.3.2 |
| Aug 82025 | OpenBao Userpass and LDAP User Lockout Bypass CVE-2025-54998Medium5.3fixed in 0.0.0-20250807212521-c52795c1ef74, 2.3.2 | Medium5.3 | 0.0.0-20250807212521-c52795c1ef74, 2.3.2 |
| Aug 82025 | OpenBao has a Timing Side-Channel in the Userpass Auth Method CVE-2025-54999Low3.7fixed in 0.0.0-20250806193356-4d9b5d3d6486, 2.3.2 | Low3.7 | 0.0.0-20250806193356-4d9b5d3d6486, 2.3.2 |
| Aug 82025 | OpenBao Login MFA Bypass of Rate Limiting and TOTP Token Reuse CVE-2025-55003Medium5.7fixed in 0.0.0-20250807113757-8340a6918f6c, 2.3.2 | Medium5.7 | 0.0.0-20250807113757-8340a6918f6c, 2.3.2 |
| Aug 82025 | OpenBao LDAP MFA Enforcement Bypass When Using Username As Alias CVE-2025-55001Medium6.5fixed in 0.0.0-20250807212521-c52795c1ef74, 2.3.2 | Medium6.5 | 0.0.0-20250807212521-c52795c1ef74, 2.3.2 |