Skip to content
openbaoGHSA-f7c3-mhj2-9pvg

OpenBao TOTP Secrets Engine Code Reuse

Medium6.5CVE-2025-55000 · Published Aug 8, 2025 · updated Jul 27, 2026

GitHub advisory

Affected versions

PackageAffectedFixed in
github.com/openbao/openbao
Go
>= 0.1.0, < 2.3.22.3.2
< 0.0.0-20250806193153-183891f8d5350.0.0-20250806193153-183891f8d535
Details and references

### Impact OpenBao's TOTP secrets engine could accept valid codes multiple times rather than strictly-once. This was caused by unexpected normalization in the underlying TOTP library. ### Patches OpenBao v2.3.2 will patch this issue. In patching, codes which were not normalized (strictly N numeric digits) will now be rejected. This is a potentially breaking change. ### Workarounds TOTP code verification is a privileged action; only trusted systems should be verifying codes. Ensure that all codes are first normalized before submitting to the OpenBao endpoint. ### References This issue was disclosed to HashiCorp and is the OpenBao equivalent of the following tickets: - https://discuss.hashicorp.com/t/hcsec-2025-17-vault-totp-secrets-engine-code-reuse/76036 - https://nvd.nist.gov/vuln/detail/CVE-2025-6014

CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Severity from
GitHub (reviewed advisory)
Weakness
CWE-156
Also known as
BIT-openbao-2025-55000, CVE-2025-55000, GO-2025-3853

More openbao advisories

All
DateAdvisory
Aug 82025OpenBao Root Namespace Operator May Elevate Token Privileges
CVE-2025-54996High7.2fixed in 0.0.0-20250806193240-9b0b5d4f345f, 2.3.2
Aug 82025Privileged OpenBao Operator May Execute Code on the Underlying Host
CVE-2025-54997Critical9.1fixed in 0.0.0-20250806194004-a14053c9679d, 2.3.2
Aug 82025OpenBao Userpass and LDAP User Lockout Bypass
CVE-2025-54998Medium5.3fixed in 0.0.0-20250807212521-c52795c1ef74, 2.3.2
Aug 82025OpenBao has a Timing Side-Channel in the Userpass Auth Method
CVE-2025-54999Low3.7fixed in 0.0.0-20250806193356-4d9b5d3d6486, 2.3.2
Aug 82025OpenBao Login MFA Bypass of Rate Limiting and TOTP Token Reuse
CVE-2025-55003Medium5.7fixed in 0.0.0-20250807113757-8340a6918f6c, 2.3.2
Aug 82025OpenBao LDAP MFA Enforcement Bypass When Using Username As Alias
CVE-2025-55001Medium6.5fixed in 0.0.0-20250807212521-c52795c1ef74, 2.3.2

Critical advisories by email

Wednesdays: the week’s critical and high advisories in the AI and data stack, with the fixed versions. Only in weeks that have some.

Double opt-in. Unsubscribe any time.