GHSA-v6r4-35f9-9rpw

Source

https://github.com/advisories/GHSA-v6r4-35f9-9rpw

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/08/GHSA-v6r4-35f9-9rpw/GHSA-v6r4-35f9-9rpw.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-v6r4-35f9-9rpw

Aliases

CVE-2025-6015

Downstream

MINI-4h2r-8vqr-96qf

Published

2025-08-01T18:31:19Z

Modified

2025-08-01T21:57:25.023476Z

Severity

5.7 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N CVSS Calculator

Summary

Hashicorp Vault has Login MFA Rate Limit Bypass Vulnerability

Details

Vault and Vault Enterprise’s (“Vault”) login MFA rate limits could be bypassed and TOTP tokens could be reused. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23.

Database specific

{
    "github_reviewed": true,
    "nvd_published_at": "2025-08-01T18:15:57Z",
    "github_reviewed_at": "2025-08-01T21:09:08Z",
    "severity": "MODERATE",
    "cwe_ids": [
        "CWE-307"
    ]
}

References

Affected packages

Go / github.com/hashicorp/vault

Package

Name: github.com/hashicorp/vault; View open source insights on deps.dev
Purl: pkg:golang/github.com/hashicorp/vault

Affected ranges

Type: SEMVER
Events: Introduced

1.10.0

Fixed

1.20.1