Vault and Vault Enterprise’s (“Vault”) user lockout feature could be bypassed for Userpass and LDAP authentication methods. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23.
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| https://discuss.hashicorp.com/t/hcsec-2025-16-vault-userpass-and-ldap-user-lockout-bypass/76035 | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
13 Aug 2025, 18:10
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Hashicorp
Hashicorp vault |
|
| References | () https://discuss.hashicorp.com/t/hcsec-2025-16-vault-userpass-and-ldap-user-lockout-bypass/76035 - Vendor Advisory | |
| CPE | cpe:2.3:a:hashicorp:vault:1.20.0:*:*:*:enterprise:*:*:* cpe:2.3:a:hashicorp:vault:*:*:*:*:enterprise:*:*:* cpe:2.3:a:hashicorp:vault:*:*:*:*:-:*:*:* |
01 Aug 2025, 18:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-08-01 18:15
Updated : 2025-08-13 18:10
NVD link : CVE-2025-6004
Mitre link : CVE-2025-6004
JSON object : View
Products Affected
hashicorp
- vault
CWE
No CWE.