CVE-2025-55000

MEDIUM EPSS 9.4%
Published Aug 9, 202510mo ago · Modified Jun 17, 20262w ago
6.5 CVSS 3.1
Medium
Find Similar
Published Aug 9, 2025 10mo ago
Last Modified Jun 17, 2026 2w ago

Description

OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In versions 0.1.0 through 2.3.1, OpenBao's TOTP secrets engine could accept valid codes multiple times rather than strictly-once. This was caused by unexpected normalization in the underlying TOTP library. To work around, ensure that all codes are first normalized before submitting to the OpenBao endpoint. TOTP code verification is a privileged action; only trusted systems should be verifying codes.

CVSS Details

Base Score
6.5
Exploitability
2.8
Impact
3.6
Vector string
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality High
Integrity None
Availability None

Threat Intelligence

EPSS Exploit Probability
9.4% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-156

Affected Products 1

VendorProductVersionRange
openbaoopenbao* <2.3.2

References 3

  • discuss.hashicorp.com https://discuss.hashicorp.com/t/hcsec-2025-17-vault-totp-secrets-engine-code-reuse/76036
    Not Applicable
  • github.com https://github.com/openbao/openbao/commit/183891f8d535d5b6eb3d79fda8200cade6de99e1
    Patch
  • github.com https://github.com/openbao/openbao/security/advisories/GHSA-f7c3-mhj2-9pvg
    Vendor Advisory

Remediation

  • github.com https://github.com/openbao/openbao/commit/183891f8d535d5b6eb3d79fda8200cade6de99e1
    Patch