Vault and Vault Enterprise’s (“Vault”) login MFA rate limits could be bypassed and TOTP tokens could be reused. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23.
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| https://discuss.hashicorp.com/t/hcsec-2025-19-vault-login-mfa-bypass-of-rate-limiting-and-totp-token-reuse/76038 | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
13 Aug 2025, 18:09
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Hashicorp
Hashicorp vault |
|
| References | () https://discuss.hashicorp.com/t/hcsec-2025-19-vault-login-mfa-bypass-of-rate-limiting-and-totp-token-reuse/76038 - Vendor Advisory | |
| CPE | cpe:2.3:a:hashicorp:vault:1.20.0:*:*:*:enterprise:*:*:* cpe:2.3:a:hashicorp:vault:*:*:*:*:enterprise:*:*:* cpe:2.3:a:hashicorp:vault:*:*:*:*:-:*:*:* |
01 Aug 2025, 18:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-08-01 18:15
Updated : 2025-08-13 18:09
NVD link : CVE-2025-6015
Mitre link : CVE-2025-6015
JSON object : View
Products Affected
hashicorp
- vault
CWE
No CWE.