Skip to content
CVE PROGRAM SOURCE RECORD6.5 Medium

CVE-2025-6013

Vault LDAP MFA Enforcement Bypass When Using Username As Alias

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
HashiCorp

Description

Vault and Vault Enterprise’s (“Vault”) ldap auth method may not have correctly enforced MFA if username_as_alias was set to true and a user had multiple CNs that are equal but with leading or trailing spaces. Fixed in Vault Community Edition 1.20.2 and Vault Enterprise 1.20.2, 1.19.8, 1.18.13, and 1.16.24.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

HashiCorp Vault

Default version status: unaffected

  • 1.10.0 to < 1.20.2affected

HashiCorp Vault Enterprise

Default version status: unaffected

  • 1.10.0 to < 1.20.2affected

References