Identity CVE · Secrets managers
CVE-2025-6010Vault username enumeration
medium
What broke
Vault returned a different error (or timing) for "user does not exist" and "wrong password." That is username enumeration. Fixed in 1.20.2. A sibling timing side-channel is CVE-2025-6011.
Why it matters
Enumeration is how the lockout bypass becomes a targeted brute force instead of a noisy spray. On a human-reachable Vault UI this is worth patching even if the score looks medium.
What to do
- Upgrade. Confirm login errors are identical for unknown and known users.
- Put the UI behind SSO. Do not offer Userpass on the internet.
Sources
Related identity CVEs
Know a primary source we should add, or a patch status that has changed? Email [email protected]. See all briefs in the identity CVE catalog, or volunteer as a CVE Analyst.
Compiled from vendor advisories, NVD, CISA KEV, and public research. CVSS figures can disagree across NVD and the CNA. Confirm affected versions against the vendor advisory before you patch. Independent, community-driven analysis. See the disclaimer.