CVE-2025-62513

MEDIUM EPSS 20.3%
Published Oct 22, 20258mo ago · Modified Jun 17, 20262w ago
5.7 CVSS 4.0
Medium
Find Similar
Published Oct 22, 2025 8mo ago
Last Modified Jun 17, 2026 2w ago

Description

OpenBao is an open source identity-based secrets management system. In versions 2.2.0 to 2.4.1, OpenBao's audit log experienced a regression wherein raw HTTP bodies used by few endpoints were not correctly redacted (HMAC'd). This impacts those using the ACME functionality of PKI, resulting in short-lived ACME verification challenge codes being leaked in the audit logs. Additionally, this impacts those using the OIDC issuer functionality of the identity subsystem, auth and token response codes along with claims could be leaked in the audit logs. ACME verification codes are not usable after verification or challenge expiry so are of limited long-term use. This issue has been patched in OpenBao 2.4.2.

CVSS Details

Base Score
5.7
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Network
Attack Complexity Low
Privileges Required High
User Interaction P
Scope X

Threat Intelligence

EPSS Exploit Probability
20.3% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-532

Affected Products 1

VendorProductVersionRange
openbaoopenbao*≥2.2.0  –  <2.4.2

References 2

  • github.com https://github.com/openbao/openbao/commit/cc2c476bac66e1d94776c2629793daec3af625f8
    Patch
  • github.com https://github.com/openbao/openbao/security/advisories/GHSA-ghfh-fmx4-26h8
    Vendor Advisory

Remediation

  • github.com https://github.com/openbao/openbao/commit/cc2c476bac66e1d94776c2629793daec3af625f8
    Patch