CVE-2025-55000: openbao — Fix

Description

OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In versions 0.1.0 through 2.3.1, OpenBao's TOTP secrets engine could accept valid codes multiple times rather than strictly-once. This was caused by unexpected normalization in the underlying TOTP library. To work around, ensure that all codes are first normalized before submitting to the OpenBao endpoint. TOTP code verification is a privileged action; only trusted systems should be verifying codes.

Is your site exposed to CVE-2025-55000?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

6.5

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness Type (CWE)

CWE-156 CWE-156

Affected Products

Vendor	Product	Versions
openbao	openbao	< 2.3.2

References

Advisories & Patches

https://github.com/openbao/openbao/commit/183891f8d535d5b6eb3d79fda8200cade6de99e1 https://github.com/openbao/openbao/security/advisories/GHSA-f7c3-mhj2-9pvg

Other References

https://discuss.hashicorp.com/t/hcsec-2025-17-vault-totp-secrets-engine-code-reuse/76036

Frequently Asked Questions

What is CVE-2025-55000? +

OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In versions 0.1.0 through 2.3.1, OpenBao's TOTP secrets engine could accept valid codes multiple times rather than strictly-once. This was caused by unexpected normalization in the underlying TOTP library. To work around, ensure that all codes are first normalized before submitting to the OpenBao endpoint. TOTP code verification is a privileged action; only trusted systems should be verifying codes. It has a CVSS v3.1 base score of 6.5 (MEDIUM).

How severe is CVE-2025-55000? +

CVE-2025-55000 has a CVSS v3.1 score of 6.5 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance.

What products are affected by CVE-2025-55000? +

CVE-2025-55000 affects products from openbao, specifically: openbao. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2025-55000? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2025-55001 6.5

OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In …

CVE-2025-6014 6.5

Vault and Vault Enterprise’s (“Vault”) TOTP Secrets Engine code validation endpoint is susceptible to code reuse within its validity period. …

CVE-2025-6013 6.5

Vault and Vault Enterprise’s (“Vault”) ldap auth method may not have correctly enforced MFA if username_as_alias was set to true …

CVE-2025-55127 5.4

HackerOne community member Dao Hoang Anh (yoyomiski) has reported an improper neutralization of whitespace in the username when adding new …

CVE-2025-54997 9.1