CVE-2025-6013

Description

HashiCorp Vault ldap auth method may not have correctly enforced MFA in github.com/hashicorp/vault

Affected packages (3)

• Bitnami/vault>= 1.10.0, < 1.20.2
• Go/github.com/hashicorp/vaultfrom 0, < 1.20.2
• Go/github.com/hashicorp/vaultfrom 0, < 1.20.2

CVSS scores

References (4)

• ADVISORYhttps://github.com/advisories/GHSA-7rx2-769v-hrwf
• ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2025-6013
• PATCHhttps://github.com/hashicorp/vault
• WEBhttps://discuss.hashicorp.com/t/hcsec-2025-20-vault-ldap-mfa-enforcement-bypass-when-using-username-as-alias/76092