CVE-2025-55003

OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In versions 2.3.1 and below, OpenBao's Login Multi-Factor Authentication (MFA) system allows enforcing MFA using Time-based One Time Password (TOTP). Due to normalization applied by the underlying TOTP library, codes were accepted which could contain whitespace; this whitespace could bypass internal rate limiting of the MFA method and allow reuse of existing MFA codes. This issue was fixed in version 2.3.2. To work around this, use of rate-limiting quotas can limit an attacker's ability to exploit this: https://openbao.org/api-docs/system/rate-limit-quotas/.

CVSS v3 5.7 MEDIUM

5.7^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.1 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://discuss.hashicorp.com/t/hcsec-2025-19-vault-login-mfa-bypass-of-rate-limiting-and-totp-token-reuse/76038	Not Applicable
https://github.com/openbao/openbao/commit/8340a6918f6c41d8f75b6c3845c376d9dc32ed19	Patch
https://github.com/openbao/openbao/security/advisories/GHSA-rxp7-9q75-vj3p	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:openbao:openbao:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2025-08-09 03:15

Updated : 2025-08-12 20:39

NVD link : CVE-2025-55003

Mitre link : CVE-2025-55003

CVE.ORG link : CVE-2025-55003

JSON object : View

Products Affected

openbao

openbao

CWE

CWE-307

Improper Restriction of Excessive Authentication Attempts

{"id": "CVE-2025-55003", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.7, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.1}]}, "published": "2025-08-09T03:15:47.030", "references": [{"url": "https://discuss.hashicorp.com/t/hcsec-2025-19-vault-login-mfa-bypass-of-rate-limiting-and-totp-token-reuse/76038", "tags": ["Not Applicable"], "source": "[email protected]"}, {"url": "https://github.com/openbao/openbao/commit/8340a6918f6c41d8f75b6c3845c376d9dc32ed19", "tags": ["Patch"], "source": "[email protected]"}, {"url": "https://github.com/openbao/openbao/security/advisories/GHSA-rxp7-9q75-vj3p", "tags": ["Vendor Advisory"], "source": "[email protected]"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-307"}]}], "descriptions": [{"lang": "en", "value": "OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In versions 2.3.1 and below, OpenBao's Login Multi-Factor Authentication (MFA) system allows enforcing MFA using Time-based One Time Password (TOTP). Due to normalization applied by the underlying TOTP library, codes were accepted which could contain whitespace; this whitespace could bypass internal rate limiting of the MFA method and allow reuse of existing MFA codes. This issue was fixed in version 2.3.2. To work around this, use of rate-limiting quotas can limit an attacker's ability to exploit this: https://openbao.org/api-docs/system/rate-limit-quotas/."}, {"lang": "es", "value": "OpenBao existe para proporcionar una soluci\u00f3n de software que permite gestionar, almacenar y distribuir datos confidenciales, como secretos, certificados y claves. En las versiones 2.3.1 y anteriores, el sistema de autenticaci\u00f3n multifactor (MFA) de inicio de sesi\u00f3n de OpenBao permite aplicar la MFA mediante contrase\u00f1as de un solo uso basadas en tiempo (TOTP). Gracias a la normalizaci\u00f3n aplicada por la librer\u00eda TOTP subyacente, se aceptaron c\u00f3digos que pod\u00edan contener espacios en blanco. Estos espacios en blanco pod\u00edan eludir la limitaci\u00f3n de velocidad interna del m\u00e9todo de MFA y permitir la reutilizaci\u00f3n de c\u00f3digos de MFA existentes. Este problema se solucion\u00f3 en la versi\u00f3n 2.3.2. Para solucionarlo, el uso de cuotas de limitaci\u00f3n de velocidad puede limitar la capacidad de un atacante para explotar esta vulnerabilidad: https://openbao.org/api-docs/system/rate-limit-quotas/."}], "lastModified": "2025-08-12T20:39:40.253", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:openbao:openbao:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5572B591-02AC-4B8F-8956-FC9A606D7F32", "versionEndExcluding": "2.3.2"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}