Riskcovery

CVE-2025-6013

Vault LDAP MFA Enforcement Bypass When Using Username As Alias

State
Published
Severity
6.5 Medium
Published
Aug 6, 2025
Updated
Feb 26, 2026
Reserved
Jun 11, 2025

Read the record on cve.org

Description

Vault and Vault Enterprise’s (“Vault”) ldap auth method may not have correctly enforced MFA if username_as_alias was set to true and a user had multiple CNs that are equal but with leading or trailing spaces. Fixed in Vault Community Edition 1.20.2 and Vault Enterprise 1.20.2, 1.19.8, 1.18.13, and 1.16.24.

Scores

CVSSScoreVectorSource
3.16.5 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:NHashiCorp

Weaknesses

  • CWE-156 Improper Neutralization of Whitespace

Affected Products

ProductVersions
VaultHashiCorp
  • 1.10.0 to before 1.20.2Affected
Vault EnterpriseHashiCorp
  • 1.10.0 to before 1.20.2Affectedfrom 1.19.8Not affectedfrom 1.18.13Not affectedfrom 1.16.24Not affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.