Start with Identity
Subscribe
Identity CVE · Secrets managers

CVE-2025-6003Vault LDAP MFA enforcement bypass

high
Product: HashiCorp VaultVendor: HashiCorpDisclosed: 2025-08-06Status: PatchedNVD ↗

What broke

Vault's LDAP auth method did not always enforce the configured MFA step. An attacker who could complete LDAP bind skipped the second factor. Fixed in the VaultFault train. NVD had not confirmed a vector at the time of the original research notes. Treat it as high until your tracker says otherwise.

Why it matters

Vault MFA is how a lot of teams sleep at night on a human-reachable UI. An LDAP MFA bypass is the same class as Blast-RADIUS and SimpleHelp: the second factor is configured, not applied.

What to do

  • Upgrade to 1.20.2+.
  • Prefer cert or OIDC auth for humans. LDAP+MFA on Vault has now failed this test once.
  • Confirm in a staging login that a password-only bind is rejected when MFA is on.

Sources

Related identity CVEs

Know a primary source we should add, or a patch status that has changed? Email [email protected]. See all briefs in the identity CVE catalog, or volunteer as a CVE Analyst.
Compiled from vendor advisories, NVD, CISA KEV, and public research. CVSS figures can disagree across NVD and the CNA. Confirm affected versions against the vendor advisory before you patch. Independent, community-driven analysis. See the disclaimer.