CVE-2025-11621

Vault AWS auth method bypass due to AWS client cache

State: Published
Severity: 8.1 High
Published: Oct 23, 2025
Updated: Feb 26, 2026
Reserved: Oct 10, 2025

Description

Vault and Vault Enterprise’s (“Vault”) AWS Auth method may be susceptible to authentication bypass if the role of the configured bound_principal_iam is the same across AWS accounts, or uses a wildcard. This vulnerability, CVE-2025-11621, is fixed in Vault Community Edition 1.21.0 and Vault Enterprise 1.21.0, 1.20.5, 1.19.11, and 1.16.27

Scores

CVSS	Score	Vector	Source
3.1	8.1 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N	HashiCorp

Weaknesses

CWE-288 Authentication Bypass Using an Alternate Path or Channel

Affected Products

Product	Versions
VaultHashiCorp	0.6.0 to before 1.21.0Affected
Vault EnterpriseHashiCorp	0.6.0 to before 1.21.0Affectedfrom 1.20.5Not affectedfrom 1.19.11Not affectedfrom 1.16.27Not affected

References

https://discuss.hashicorp.com/t/hcsec-2025-30-vault-aws-auth-method-authentication-bypass-through-mishandling-of-cache-entries/76709

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.