OpenBao Userpass and LDAP User Lockout Bypass
Medium5.3CVE-2025-54998 · Published Aug 8, 2025 · updated Jul 27, 2026
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| github.com/openbao/openbao Go | >= 0.1.0, < 2.3.2 | 2.3.2 |
| < 0.0.0-20250807212521-c52795c1ef74 | 0.0.0-20250807212521-c52795c1ef74 |
Details and references
### Impact Attackers could bypass the automatic user lockout mechanisms in the OpenBao Userpass or LDAP auth systems. This was caused by different aliasing between pre-flight and full login request user entity alias attributions. ### Patches OpenBao v2.3.2 will patch this issue. ### Workarounds Existing users may apply rate-limiting quotas on the authentication endpoints: https://openbao.org/api-docs/system/rate-limit-quotas/ ### References This issue was disclosed to HashiCorp and is the OpenBao equivalent of the following tickets: - https://discuss.hashicorp.com/t/hcsec-2025-16-vault-userpass-and-ldap-user-lockout-bypass/76035 - https://nvd.nist.gov/vuln/detail/CVE-2025-6004
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-307
- Also known as
- BIT-openbao-2025-54998, CVE-2025-54998, GO-2025-3855
- github.com/openbao/openbao/security/advisories/GHSA-j3xv-7fxp-gfhx
- nvd.nist.gov/vuln/detail/CVE-2025-54998
- nvd.nist.gov/vuln/detail/CVE-2025-6004
- github.com/openbao/openbao/commit/c52795c1ef746c7f2c510f9225aa8ccbbd44f9fc
- discuss.hashicorp.com/t/hcsec-2025-16-vault-userpass-and-ldap-user-lockout-bypass/76035
- github.com/openbao/openbao
More openbao advisories
All| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Aug 82025 | OpenBao Root Namespace Operator May Elevate Token Privileges CVE-2025-54996High7.2fixed in 0.0.0-20250806193240-9b0b5d4f345f, 2.3.2 | High7.2 | 0.0.0-20250806193240-9b0b5d4f345f, 2.3.2 |
| Aug 82025 | Privileged OpenBao Operator May Execute Code on the Underlying Host CVE-2025-54997Critical9.1fixed in 0.0.0-20250806194004-a14053c9679d, 2.3.2 | Critical9.1 | 0.0.0-20250806194004-a14053c9679d, 2.3.2 |
| Aug 82025 | OpenBao has a Timing Side-Channel in the Userpass Auth Method CVE-2025-54999Low3.7fixed in 0.0.0-20250806193356-4d9b5d3d6486, 2.3.2 | Low3.7 | 0.0.0-20250806193356-4d9b5d3d6486, 2.3.2 |
| Aug 82025 | OpenBao TOTP Secrets Engine Code Reuse CVE-2025-55000Medium6.5fixed in 0.0.0-20250806193153-183891f8d535, 2.3.2 | Medium6.5 | 0.0.0-20250806193153-183891f8d535, 2.3.2 |
| Aug 82025 | OpenBao Login MFA Bypass of Rate Limiting and TOTP Token Reuse CVE-2025-55003Medium5.7fixed in 0.0.0-20250807113757-8340a6918f6c, 2.3.2 | Medium5.7 | 0.0.0-20250807113757-8340a6918f6c, 2.3.2 |
| Aug 82025 | OpenBao LDAP MFA Enforcement Bypass When Using Username As Alias CVE-2025-55001Medium6.5fixed in 0.0.0-20250807212521-c52795c1ef74, 2.3.2 | Medium6.5 | 0.0.0-20250807212521-c52795c1ef74, 2.3.2 |