Identity CVE · Secrets managers
CVE-2025-6004Vault Userpass and LDAP lockout bypass via username case
medium · CVSS 5.3
What broke
Vault's Userpass and LDAP auth methods counted lockout per exact string but accepted login on a case-insensitive match. Admin, admin, and ADMIN were three lockout buckets and one account. CVSS 5.3. Fixed in 1.20.2.
Why it matters
Lockout is the control that makes password auth survivable. A case-permutation bypass is a brute-force enabler on the box that holds the rest of your secrets. Pair with the username-enumeration pair (CVE-2025-6010, CVE-2025-6011).
What to do
- Upgrade. Then normalize usernames to a single case in the auth method.
- Prefer phishing-resistant or cert auth for humans who can reach Vault.
Sources
Related identity CVEs
Know a primary source we should add, or a patch status that has changed? Email [email protected]. See all briefs in the identity CVE catalog, or volunteer as a CVE Analyst.
Compiled from vendor advisories, NVD, CISA KEV, and public research. CVSS figures can disagree across NVD and the CNA. Confirm affected versions against the vendor advisory before you patch. Independent, community-driven analysis. See the disclaimer.