CVE-2025-55000

MEDIUM

6.5

Descripcion

OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In versions 0.1.0 through 2.3.1, OpenBao's TOTP secrets engine could accept valid codes multiple times rather than strictly-once. This was caused by unexpected normalization in the underlying TOTP library. To work around, ensure that all codes are first normalized before submitting to the OpenBao endpoint. TOTP code verification is a privileged action; only trusted systems should be verifying codes.

Detalles CVE

Puntuacion CVSS v3.16.5

SeveridadMEDIUM

Vector CVSSCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Vector de ataqueNETWORK

ComplejidadLOW

Privilegios requeridosLOW

Interaccion usuarioNONE

Publicado8/9/2025

Ultima modificacion11/13/2025

Fuentenvd

Avistamientos honeypot0

Productos afectados

openbao:openbao

Debilidades (CWE)

CWE-156

Referencias

https://discuss.hashicorp.com/t/hcsec-2025-17-vault-totp-secrets-engine-code-reuse/76036(security-advisories@github.com)

https://github.com/openbao/openbao/commit/183891f8d535d5b6eb3d79fda8200cade6de99e1(security-advisories@github.com)

https://github.com/openbao/openbao/security/advisories/GHSA-f7c3-mhj2-9pvg(security-advisories@github.com)

Correlaciones IOC

Sin correlaciones registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.