CVE-2025-3879

Vault’s Azure Authentication Method bound_location Restriction Could be Bypassed on Login

State: Published
Severity: 6.6 Medium
Published: May 2, 2025
Updated: May 2, 2025
Reserved: Apr 22, 2025

Description

Vault Community, Vault Enterprise (“Vault”) Azure Auth method did not correctly validate the claims in the Azure-issued token, resulting in the potential bypass of the bound_locations parameter on login. Fixed in Vault Community Edition 1.19.1 and Vault Enterprise 1.19.1, 1.18.7, 1.17.14, 1.16.18.

Scores

CVSS	Score	Vector	Source
3.1	6.6 Medium	CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H	HashiCorp

Weaknesses

CWE-863 Incorrect Authorization

Affected Products

Product	Versions
VaultHashiCorp	0.10.0 to before 1.19.1Affected
Vault EnterpriseHashiCorp	0.10.0 to before 1.19.1Affectedfrom 1.19.1Not affectedfrom 1.18.6Not affectedfrom 1.17.13Not affectedfrom 1.16.16Not affected

References

https://discuss.hashicorp.com/t/hcsec-2025-07-vault-s-azure-authentication-method-bound-location-restriction-could-be-bypassed-on-login/74716

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.