← Back

CVE-2025-6015

nvd nist
Published: Aug 1, 2025Modified: Jun 17, 2026

JSON object

Loading...
5.7
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Exploitability: 2.1 / Impact: 3.6
Source: security@hashicorp.com (Secondary)

Description

Vault and Vault Enterprise’s (“Vault”) login MFA rate limits could be bypassed and TOTP tokens could be reused. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23.

Affected (5)

Products: Hashicorp: Vault
Hashicorp
1 product
Vault
Configuration A
5 vulnerable
Vulnerable SoftwareAffected Versions
Hashicorp
Vault
From 1.10.0 to 1.20.1
Vault
From 1.10.0 to 1.16.23
Vault
From 1.17.0 to 1.18.12
Vault
From 1.19.0 to 1.19.7
Vault
Version 1.20.0

Related CWEs

CWE-307
Improper Restriction of Excessive Authentication Attempts
The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks.

References (1)

Source: security@hashicorp.com
Vendor Advisory

Timeline

No history available yet.