GHSA-rxp7-9q75-vj3p

Source

https://github.com/advisories/GHSA-rxp7-9q75-vj3p

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/08/GHSA-rxp7-9q75-vj3p/GHSA-rxp7-9q75-vj3p.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-rxp7-9q75-vj3p

Aliases

Published

2025-08-08T14:44:49Z

Modified

2025-08-11T18:42:13.877398Z

Severity

5.7 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N CVSS Calculator

Summary

OpenBao Login MFA Bypass of Rate Limiting and TOTP Token Reuse

Details

Impact

OpenBao's Login Multi-Factor Authentication (MFA) system allows enforcing MFA using Time-based One Time Password (TOTP). Due to normalization applied by the underlying TOTP library, codes were accepted which could contain whitespace; this whitespace could bypass internal rate limiting of the MFA method and allow reuse of existing MFA codes.

Patches

OpenBao v2.3.2 will patch this issue.

Workarounds

Use of rate-limiting quotas can limit an attacker's ability to exploit this: https://openbao.org/api-docs/system/rate-limit-quotas/

References

This issue was disclosed to HashiCorp and is the OpenBao equivalent of the following tickets:

https://discuss.hashicorp.com/t/hcsec-2025-19-vault-login-mfa-bypass-of-rate-limiting-and-totp-token-reuse/76038
https://nvd.nist.gov/vuln/detail/CVE-2025-6015

Database specific

{
    "severity": "MODERATE",
    "github_reviewed": true,
    "nvd_published_at": "2025-08-09T03:15:47Z",
    "cwe_ids": [
        "CWE-307"
    ],
    "github_reviewed_at": "2025-08-08T14:44:49Z"
}

References

Affected packages

Go / github.com/openbao/openbao

Package

Name: github.com/openbao/openbao; View open source insights on deps.dev
Purl: pkg:golang/github.com/openbao/openbao

Affected ranges

Type: SEMVER
Events: Introduced

0.1.0

Fixed

2.3.2

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/08/GHSA-rxp7-9q75-vj3p/GHSA-rxp7-9q75-vj3p.json"

Go / github.com/openbao/openbao

Package

Name: github.com/openbao/openbao; View open source insights on deps.dev
Purl: pkg:golang/github.com/openbao/openbao

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.0.0-20250807113757-8340a6918f6c

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/08/GHSA-rxp7-9q75-vj3p/GHSA-rxp7-9q75-vj3p.json"