Vault and Vault Enterprise (“Vault”) TLS certificate auth method did not correctly validate client certificates when configured with a non-CA certificate as trusted certificate. In this configuration, an attacker may be able to craft a malicious certificate that could be used to bypass authentication. Fixed in Vault 1.15.5 and 1.14.10.
There we an error on the way vault was validating the OCSP for non-CA TLS certificates. Although the signature was properly validated if there were any error regarding the certificate the OCSP response object were kept around and sent up through the stack. This ends up causing vault to eventually ignore such errors in certain conditions, allowing crafted certificates to be accepted as a valid login method. Commit: https://github.com/hashicorp/vault/pull/26091/commits/6347d0a2e5e2a3d417ee1369618ec72b127ecfba