Advisoriesby IbisOpenBaoGHSA-j3xv-7fxp-gfhx
OpenBao Userpass and LDAP User Lockout Bypass
Fix: upgrade to 0.0.0-20250807212521-c52795c1ef74 or later (2 fixed versions below)
Impact
Attackers could bypass the automatic user lockout mechanisms in the OpenBao Userpass or LDAP auth systems. This was caused by different aliasing between pre-flight and full login request user entity alias attributions.
Patches
OpenBao v2.3.2 will patch this issue.
Workarounds
Existing users may apply rate-limiting quotas on the authentication endpoints: https://openbao.org/api-docs/system/rate-limit-quotas/
References
This issue was disclosed to HashiCorp and is the OpenBao equivalent of the following tickets:
- https://discuss.hashicorp.com/t/hcsec-2025-16-vault-userpass-and-ldap-user-lockout-bypass/76035
- https://nvd.nist.gov/vuln/detail/CVE-2025-6004
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| github.com/openbao/openbao Go | >= 0.1.0, < 2.3.2 | 2.3.2 |
| < 0.0.0-20250807212521-c52795c1ef74 | 0.0.0-20250807212521-c52795c1ef74 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-307
- Also known as
- BIT-openbao-2025-54998, CVE-2025-54998, GO-2025-3855
- github.com/openbao/openbao/security/advisories/GHSA-j3xv-7fxp-gfhx
- nvd.nist.gov/vuln/detail/CVE-2025-54998
- nvd.nist.gov/vuln/detail/CVE-2025-6004
- github.com/openbao/openbao/commit/c52795c1ef746c7f2c510f9225aa8ccbbd44f9fc
- discuss.hashicorp.com/t/hcsec-2025-16-vault-userpass-and-ldap-user-lockout-bypass/76035
- github.com/openbao/openbao
More OpenBao advisories
All OpenBao
OpenBao LDAP MFA Enforcement Bypass When Using Username As AliasCVE-2025-55001fixed in 0.0.0-20250807212521-c52795c1ef74 +1OpenBao Login MFA Bypass of Rate Limiting and TOTP Token ReuseCVE-2025-55003fixed in 0.0.0-20250807113757-8340a6918f6c +1OpenBao TOTP Secrets Engine Code ReuseCVE-2025-55000fixed in 0.0.0-20250806193153-183891f8d535 +1OpenBao has a Timing Side-Channel in the Userpass Auth MethodCVE-2025-54999fixed in 0.0.0-20250806193356-4d9b5d3d6486 +1Privileged OpenBao Operator May Execute Code on the Underlying HostCVE-2025-54997fixed in 0.0.0-20250806194004-a14053c9679d +1OpenBao Root Namespace Operator May Elevate Token PrivilegesCVE-2025-54996fixed in 0.0.0-20250806193240-9b0b5d4f345f +1