← CVE Intelligence

CVE-2025-6015

Vault Login MFA Bypass of Rate Limiting and TOTP Code Reuse PUBLISHED

Description (CNA)

Vault and Vault Enterprise’s (“Vault”) login MFA rate limits could be bypassed and TOTP tokens could be reused. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23.

Affected (CNA)

Vendor / productVersions
HashiCorp / Vaultaffected 1.10.0 before 1.20.1
HashiCorp / Vault Enterpriseaffected 1.10.0 before 1.20.1

CWE

CWE-307

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.