CVE-2025-11621

Published: Oct 23, 2025Modified: Jun 17, 2026

8.1

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Exploitability: 2.8 / Impact: 5.2

Source: security@hashicorp.com (Secondary)

Description

Vault and Vault Enterprise’s (“Vault”) AWS Auth method may be susceptible to authentication bypass if the role of the configured bound_principal_iam is the same across AWS accounts, or uses a wildcard. This vulnerability, CVE-2025-11621, is fixed in Vault Community Edition 1.21.0 and Vault Enterprise 1.21.0, 1.20.5, 1.19.11, and 1.16.27

Affected (5)

Products: Hashicorp: Vault

Hashicorp

1 product

Vault

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Hashicorp Vault	From 0.6.0 to 1.21.0
Hashicorp Vault	From 0.6.0 to 1.16.27
Hashicorp Vault	From 1.18.0 to 1.18.15
Hashicorp Vault	From 1.19.0 to 1.19.11
Hashicorp Vault	From 1.20.0 to 1.20.5

Related CWEs

CWE-288

Authentication Bypass Using an Alternate Path or Channel

A product requires authentication, but the product has an alternate path or channel that does not require authentication.

References (1)

https://discuss.hashicorp.com/t/hcsec-2025-30-vault-aws-auth-method-authentication-bypass-through-mishandling-of-cache-entries/76709

Source: security@hashicorp.com

Vendor Advisory

Timeline

No history available yet.