← CVE Intelligence

CVE-2025-6011

Timing Side-Channel in Vault’s Userpass Auth Method PUBLISHED

Description (CNA)

A timing side channel in Vault and Vault Enterprise’s (“Vault”) userpass auth method allowed an attacker to distinguish between existing and non-existing users, and potentially enumerate valid usernames for Vault’s Userpass auth method. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23.

Affected (CNA)

Vendor / productVersions
HashiCorp / Vaultaffected 0 before 1.20.1
HashiCorp / Vault Enterpriseaffected 0 before 1.20.1

CWE

CWE-203

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.