← Back

CVE-2025-6004

nvd nist
Published: Aug 1, 2025Modified: Jun 17, 2026

JSON object

Loading...
5.3
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Exploitability: 3.9 / Impact: 1.4
Source: security@hashicorp.com (Secondary)

Description

Vault and Vault Enterprise’s (“Vault”) user lockout feature could be bypassed for Userpass and LDAP authentication methods. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23.

Affected (5)

Products: Hashicorp: Vault
Hashicorp
1 product
Vault
Configuration A
5 vulnerable
Vulnerable SoftwareAffected Versions
Hashicorp
Vault
From 1.13.0 to 1.20.1
Vault
From 1.13.0 to 1.16.23
Vault
From 1.17.0 to 1.18.12
Vault
From 1.19.0 to 1.19.7
Vault
Version 1.20.0

Related CWEs

CWE-307
Improper Restriction of Excessive Authentication Attempts
The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks.

References (1)

Source: security@hashicorp.com
Vendor Advisory

Timeline

No history available yet.