Vault Login MFA Bypass of Rate Limiting and TOTP Code Reuse

CVE Details

Basic Information

Title Vault Login MFA Bypass of Rate Limiting and TOTP Code Reuse
Type cve
Published 2025-08-01T18:03:53.214Z
Modified 2025-08-01T18:35:17.893Z

Product Information

Vendor HashiCorp
Product Vault
Version 1.10.0

CVSS Information

Base Score 5.7 (MEDIUM)
Attack Vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Affected Products

  • HashiCorp Vault 1.10.0
  • HashiCorp Vault Enterprise 1.10.0

Additional Information

CWE List CWE-307
Source HashiCorp

Description

Vault and Vault Enterprise’s (“Vault”) login MFA rate limits could be bypassed and TOTP tokens could be reused. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23.

💭 Join the Security Discussion

🔒 Your email address will not be published. Required fields are marked *

⚠️ Please be respectful and constructive in your comments. Security discussions should remain professional.