Start with Identity
Subscribe
Identity CVE · Secrets managers

CVE-2025-6013Vault TOTP and LDAP EntityID reuse

high
Product: HashiCorp VaultVendor: HashiCorpDisclosed: 2025-08-06Status: PatchedNVD ↗

What broke

Vault could reuse an EntityID across TOTP and LDAP auth methods. The entity you thought was "Alice via LDAP" could become bound to a different login. Fixed in 1.20.2.

Why it matters

EntityID is Vault's internal identity. Reusing it is account merge without consent, the same class as Keycloak First Broker Login. Policies, MFA state, and audit trails attach to the wrong person.

What to do

  • Upgrade. Then inspect identity/entity for merges you did not intend.
  • Do not share aliases across auth methods unless you have a written reason.

Sources

Related identity CVEs

Know a primary source we should add, or a patch status that has changed? Email [email protected]. See all briefs in the identity CVE catalog, or volunteer as a CVE Analyst.
Compiled from vendor advisories, NVD, CISA KEV, and public research. CVSS figures can disagree across NVD and the CNA. Confirm affected versions against the vendor advisory before you patch. Independent, community-driven analysis. See the disclaimer.