Bug 2386025 (CVE-2025-6011)

Summary: CVE-2025-6011 github.com/hashicorp/vault: Vault Userpass Authentication Timing Vulnerability
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: bkabrda, caswilli, kaycoth, lball, manissin, ngough, veshanka
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in github.com/hashicorp/vault. The Userpass authentication method exhibits a timing vulnerability, allowing an attacker to determine whether a username exists within Vault by measuring response times, and enables potential enumeration of valid usernames. This vulnerability allows a network-based attacker to exploit this side channel to infer user presence without authentication credentials and to discover user accounts without authorization.
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2025-08-01 19:01:24 UTC
A timing side channel in Vault and Vault Enterprise’s (“Vault”) userpass auth method allowed an attacker to distinguish between existing and non-existing users, and potentially enumerate valid usernames for Vault’s Userpass auth method. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23.