Skip to content
CVE PROGRAM SOURCE RECORD5.3 Medium

CVE-2025-6004

Vault Userpass and LDAP User Lockout Bypass

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
HashiCorp

Description

Vault and Vault Enterprise’s (“Vault”) user lockout feature could be bypassed for Userpass and LDAP authentication methods. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

HashiCorp Vault

Default version status: unaffected

  • 1.13.0 to < 1.20.1affected

HashiCorp Vault Enterprise

Default version status: unaffected

  • 1.13.0 to < 1.20.1affected

References