CVE-2025-55000

MEDIUM

6.5

Descricao

OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In versions 0.1.0 through 2.3.1, OpenBao's TOTP secrets engine could accept valid codes multiple times rather than strictly-once. This was caused by unexpected normalization in the underlying TOTP library. To work around, ensure that all codes are first normalized before submitting to the OpenBao endpoint. TOTP code verification is a privileged action; only trusted systems should be verifying codes.

Detalhes CVE

Pontuacao CVSS v3.16.5

SeveridadeMEDIUM

Vetor CVSSCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Vetor de ataqueNETWORK

ComplexidadeLOW

Privilegios necessariosLOW

Interacao do usuarioNONE

Publicado8/9/2025

Ultima modificacao11/13/2025

Fontenvd

Avistamentos honeypot0

Produtos afetados

openbao:openbao

Fraquezas (CWE)

CWE-156

Referencias

https://discuss.hashicorp.com/t/hcsec-2025-17-vault-totp-secrets-engine-code-reuse/76036(security-advisories@github.com)

https://github.com/openbao/openbao/commit/183891f8d535d5b6eb3d79fda8200cade6de99e1(security-advisories@github.com)

https://github.com/openbao/openbao/security/advisories/GHSA-f7c3-mhj2-9pvg(security-advisories@github.com)

Correlacoes IOC

Sem correlacoes registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.