← Back

CVE-2025-6014

nvd nist
Published: Aug 1, 2025Modified: Jun 17, 2026

JSON object

Loading...
6.5
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Exploitability: 2.8 / Impact: 3.6
Source: security@hashicorp.com (Secondary)

Description

Vault and Vault Enterprise’s (“Vault”) TOTP Secrets Engine code validation endpoint is susceptible to code reuse within its validity period. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23.

Affected (5)

Products: Hashicorp: Vault
Hashicorp
1 product
Vault
Configuration A
5 vulnerable
Vulnerable SoftwareAffected Versions
Hashicorp
Vault
Before 1.20.1
Vault
Before 1.16.23
Vault
From 1.17.0 to 1.18.12
Vault
From 1.19.0 to 1.19.7
Vault
Version 1.20.0

Related CWEs

CWE-156
Improper Neutralization of Whitespace
The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as whitespace when they are sent to a downstream component.

References (1)

Source: security@hashicorp.com
Vendor Advisory

Timeline

No history available yet.