Advisoriesby IbisVaultGHSA-qgj7-fmq2-6cc4
Hashicorp Vault has Lockout Feature Authentication Bypass
Fix: upgrade to 1.20.1 or later
Vault and Vault Enterprise’s (“Vault”) user lockout feature could be bypassed for Userpass and LDAP authentication methods. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| github.com/hashicorp/vault Go | >= 1.13.0, < 1.20.1 | 1.20.1 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-307
- Also known as
- BIT-vault-2025-6004, CVE-2025-6004, GO-2025-3840
More Vault advisories
All Vault
Hashicorp Vault has Incorrect Validation for Non-CA CertificatesCVE-2025-6037fixed in 1.20.1Hashicorp Vault has Privilege Escalation VulnerabilityCVE-2025-5999fixed in 1.20.0Hashicorp Vault has Code Execution Vulnerability via Plugin ConfigurationCVE-2025-6000fixed in 1.20.1Hashicorp Vault has an Observable Discrepancy on Existing and Non-Existing UsersCVE-2025-6011fixed in 1.20.1Hashicorp Vault's TOTP Secrets Engine Susceptible to Code ReuseCVE-2025-6014fixed in 1.20.1Hashicorp Vault has Login MFA Rate Limit Bypass VulnerabilityCVE-2025-6015fixed in 1.20.1