Advisoriesby IbisVaultGHSA-qv3p-fmv3-9hww
Hashicorp Vault's TOTP Secrets Engine Susceptible to Code Reuse
Fix: upgrade to 1.20.1 or later
Vault and Vault Enterprise’s (“Vault”) TOTP Secrets Engine code validation endpoint is susceptible to code reuse within its validity period. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| github.com/hashicorp/vault Go | < 1.20.1 | 1.20.1 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-156
- Also known as
- BIT-vault-2025-6014, CVE-2025-6014, GO-2025-3841
More Vault advisories
All Vault
Hashicorp Vault has Incorrect Validation for Non-CA CertificatesCVE-2025-6037fixed in 1.20.1Hashicorp Vault has Privilege Escalation VulnerabilityCVE-2025-5999fixed in 1.20.0Hashicorp Vault has Code Execution Vulnerability via Plugin ConfigurationCVE-2025-6000fixed in 1.20.1Hashicorp Vault has an Observable Discrepancy on Existing and Non-Existing UsersCVE-2025-6011fixed in 1.20.1Hashicorp Vault has Lockout Feature Authentication BypassCVE-2025-6004fixed in 1.20.1Hashicorp Vault has Login MFA Rate Limit Bypass VulnerabilityCVE-2025-6015fixed in 1.20.1