GHSA-7rx2-769v-hrwf

Source

https://github.com/advisories/GHSA-7rx2-769v-hrwf

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/08/GHSA-7rx2-769v-hrwf/GHSA-7rx2-769v-hrwf.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-7rx2-769v-hrwf

Aliases

BIT-vault-2025-6013
CVE-2025-6013

Downstream

MINI-rf9r-m9w5-w4qv

Published

2025-08-06T12:31:20Z

Modified

2025-08-08T07:29:40.556850Z

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N CVSS Calculator

Summary

HashiCorp Vault ldap auth method may not have correctly enforced MFA

Details

Vault and Vault Enterprise’s (“Vault”) ldap auth method may not have correctly enforced MFA if usernameasalias was set to true and a user had multiple CNs that are equal but with leading or trailing spaces. Fixed in Vault Community Edition 1.20.2 and Vault Enterprise 1.20.2, 1.19.8, 1.18.13, and 1.16.24.

Database specific

{
    "cwe_ids": [
        "CWE-156"
    ],
    "nvd_published_at": "2025-08-06T10:15:35Z",
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2025-08-06T18:14:06Z"
}

References

Affected packages

Go / github.com/hashicorp/vault

Package

Name: github.com/hashicorp/vault; View open source insights on deps.dev
Purl: pkg:golang/github.com/hashicorp/vault

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.20.2