OpenBao has a Timing Side-Channel in the Userpass Auth Method

### Impact When using OpenBao's `userpass` auth method, user enumeration was possible due to timing difference between non-existent users and users with stored credentials. This is independent of whether the supplied credentials were valid for the given user. ### Patches OpenBao v2.3.2 will patch this issue. ### Workarounds Users may use another auth method or apply rate limiting quotas to limit the number of requests in a period of time: https://openbao.org/api-docs/system/rate-limit-quotas/ ### References This issue was disclosed to HashiCorp and is the OpenBao equivalent of the following tickets: - https://discuss.hashicorp.com/t/hcsec-2025-15-timing-side-channel-in-vault-s-userpass-auth-method/76034 - https://nvd.nist.gov/vuln/detail/CVE-2025-6011 Barring further information, this is also assumed to cover and remediate the following additional vulnerability: - https://discuss.hashicorp.com/t/hcsec-2025-21-vault-user-enumeration-in-userpass-auth-method/76095 - https://nvd.nist.gov/vuln/detail/CVE-2025-6010 If this is not the case as further details emerge, a new CVE will be assigned for remediating that. Otherwise, no further CVE will be sought.

CVSS 3.1

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Severity from

GitHub (reviewed advisory)

Weakness

CWE-203

Also known as

BIT-openbao-2025-54999, CVE-2025-54999, GO-2025-3854

• github.com/openbao/openbao/security/advisories/GHSA-hh28-h22f-8357
• nvd.nist.gov/vuln/detail/CVE-2025-54999
• nvd.nist.gov/vuln/detail/CVE-2025-6011
• github.com/openbao/openbao/commit/4d9b5d3d6486ab9fbd5b644173fa0097015d6626
• discuss.hashicorp.com/t/hcsec-2025-15-timing-side-channel-in-vault-s-userpass-auth-method/76034
• discuss.hashicorp.com/t/hcsec-2025-21-vault-user-enumeration-in-userpass-auth-method/76095
• github.com/openbao/openbao