Start with Identity
Identity CVE · Secrets managers

CVE-2025-6011Vault timing side-channel username enumeration

medium
Product: HashiCorp VaultVendor: HashiCorpDisclosed: 2025-08-06Status: PatchedNVD ↗

What broke

Vault took a measurably different amount of time to reject an unknown username versus a known one. That is a timing side-channel for username enumeration, next to the explicit error leak in CVE-2025-6010. Fixed in 1.20.2.

Why it matters

Closing the error string and leaving the timing is how enumeration advisories come back a quarter later. Take both IDs in the same change.

What to do

  • Upgrade. If you still expose Userpass, pad auth responses to a constant time on your reverse proxy as defense in depth.
  • Prefer SSO. Enumeration only matters if the attacker can hit the login method.

Sources

Know a primary source we should add, or a patch status that has changed? Email [email protected]. See all briefs in the identity CVE catalog, or volunteer as a CVE Analyst.
Compiled from vendor advisories, NVD, CISA KEV, and public research. CVSS figures can disagree across NVD and the CNA. Confirm affected versions against the vendor advisory before you patch. Independent, community-driven analysis. See the disclaimer.