AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

VaultGHSA-v6r4-35f9-9rpw

Hashicorp Vault has Login MFA Rate Limit Bypass Vulnerability

Vault

CVE-2025-6015 · Published Aug 1, 2025 · updated Sep 10, 2026

Medium5.7
Fix: upgrade to 1.20.1 or later
GitHub advisory

Vault and Vault Enterprise’s (“Vault”) login MFA rate limits could be bypassed and TOTP tokens could be reused. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23.

Affected versions

PackageAffectedFixed in
github.com/hashicorp/vault
Go
>= 1.10.0, < 1.20.11.20.1
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Severity from
GitHub (reviewed advisory)
Weakness
CWE-307
Also known as
BIT-vault-2025-6015, CVE-2025-6015, GO-2025-3842

More Vault advisories

All Vault
Medium 6.8Aug 1, 2025Hashicorp Vault has Incorrect Validation for Non-CA CertificatesCVE-2025-6037fixed in 1.20.1High 7.2Aug 1, 2025Hashicorp Vault has Privilege Escalation VulnerabilityCVE-2025-5999fixed in 1.20.0Critical 9.1Aug 1, 2025Hashicorp Vault has Code Execution Vulnerability via Plugin ConfigurationCVE-2025-6000fixed in 1.20.1Low 3.7Aug 1, 2025Hashicorp Vault has an Observable Discrepancy on Existing and Non-Existing UsersCVE-2025-6011fixed in 1.20.1Medium 5.3Aug 1, 2025Hashicorp Vault has Lockout Feature Authentication BypassCVE-2025-6004fixed in 1.20.1Medium 6.5Aug 1, 2025Hashicorp Vault's TOTP Secrets Engine Susceptible to Code ReuseCVE-2025-6014fixed in 1.20.1