Skip to content
CVE PROGRAM SOURCE RECORD6.5 Medium

CVE-2025-6014

Vault TOTP Secrets Engine Code Reuse

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
HashiCorp

Description

Vault and Vault Enterprise’s (“Vault”) TOTP Secrets Engine code validation endpoint is susceptible to code reuse within its validity period. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

HashiCorp Vault

Default version status: unaffected

  • 0 to < 1.20.1affected

HashiCorp Vault Enterprise

Default version status: unaffected

  • 0 to < 1.20.1affected

References