Start with Identity
Subscribe
Identity CVE · Secrets managers

CVE-2025-6016Vault TOTP login MFA bypass

high
Product: HashiCorp VaultVendor: HashiCorpDisclosed: 2025-08-06Status: PatchedNVD ↗

What broke

Vault's TOTP login MFA did not always run. A password (or another first factor) was enough. Fixed in 1.20.2. Like CVE-2025-6003, NVD scoring lagged the vendor/researcher write-up.

Why it matters

TOTP is already the weakest common MFA. Skipping it entirely is an MFA bypass, not a TOTP implementation bug. Anyone who put Vault's UI on a VPN and called it "MFA protected" needs to revisit that sentence.

What to do

  • Upgrade. Then test a login with a wrong TOTP and a missing TOTP. Both must fail.
  • Move human Vault access to phishing-resistant MFA or remove human access and use machine auth.

Sources

Related identity CVEs

Know a primary source we should add, or a patch status that has changed? Email [email protected]. See all briefs in the identity CVE catalog, or volunteer as a CVE Analyst.
Compiled from vendor advisories, NVD, CISA KEV, and public research. CVSS figures can disagree across NVD and the CNA. Confirm affected versions against the vendor advisory before you patch. Independent, community-driven analysis. See the disclaimer.