# Vault login MFA rate-limit bypass and TOTP reuse

Source: https://startwithidentity.com/cves/cve-2025-6015/
Last updated: 2026-10-31
License: content by Start with Identity. Cite the source URL.

---

## What broke

Vault's login MFA rate limits could be bypassed and TOTP codes could be reused, according to [NVD](https://nvd.nist.gov/vuln/detail/CVE-2025-6015), so an attacker holding the first factor could keep guessing or replay a code the user had already entered. Fixed in Vault 1.20.2 and the matching Enterprise releases. It sits alongside the LDAP MFA enforcement bypass in [CVE-2025-6013](https://startwithidentity.com/cves/cve-2025-6013/).

## Why it matters

[TOTP](https://startwithidentity.com/glossary/totp/) is already the weakest common MFA. Skipping it entirely is an MFA bypass, not a TOTP implementation bug. Anyone who put Vault's UI on a VPN and called it "MFA protected" needs to revisit that sentence.

## What to do

- Upgrade. Then test a login with a wrong TOTP and a missing TOTP. Both must fail.
- Move human Vault access to [phishing-resistant MFA](https://startwithidentity.com/glossary/phishing-resistant-mfa/) or remove human access and use machine auth.

## After you patch

A vault compromise is not one credential, it is every credential the vault held or could issue.

- **Rotate everything in scope**, including secrets the vault issued dynamically during the exposure window, because a lease that was valid then may still be valid now.
- **Revoke active leases and tokens**, then review the audit device log for reads you cannot attribute to a known workload.
- **Rotate the vault's own credentials**: unseal or recovery keys, root tokens, and any authentication backend configuration that could be used to re-enter.
- **Rotate downstream credentials the vault brokered**, cloud roles, database users, and PKI certificates, since the point of the vault is that it can mint them. See [secrets rotation](https://startwithidentity.com/glossary/secrets-rotation/) and [what is secrets management](https://startwithidentity.com/guides/fundamentals/what-is-secrets-management/).

## Sources

- [NVD: CVE-2025-6015](https://nvd.nist.gov/vuln/detail/cve-2025-6015)