Bug 2386029 (CVE-2025-6015)

Summary: CVE-2025-6015 github.com/hashicorp/vault: Vault TOTP Rate Limit Bypass
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: bkabrda, caswilli, kaycoth, lball, manissin, ngough, veshanka
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in github.com/hashicorp/vault. The Time-based One-Time Password (TOTP) rate-limiting mechanism can be bypassed, allowing the reuse of TOTP tokens. This vulnerability allows a remote attacker to trigger authentication attempts. Successful exploitation can lead to the repeated use of TOTP tokens during authentication, resulting in unauthorized access.
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2025-08-01 19:01:41 UTC
Vault and Vault Enterprise’s (“Vault”) login MFA rate limits could be bypassed and TOTP tokens could be reused. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23.