CVE-2025-6013: vault — Fix

Description

Vault and Vault Enterprise’s (“Vault”) ldap auth method may not have correctly enforced MFA if username_as_alias was set to true and a user had multiple CNs that are equal but with leading or trailing spaces. Fixed in Vault Community Edition 1.20.2 and Vault Enterprise 1.20.2, 1.19.8, 1.18.13, and 1.16.24.

Is your site exposed to CVE-2025-6013?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

6.5

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Weakness Type (CWE)

CWE-156 CWE-156

Affected Products

Vendor	Product	Versions
hashicorp	vault	1.10.0 — 1.15.16
hashicorp	vault	1.10.0 — 1.20.2
hashicorp	vault	1.16.0 — 1.16.24
hashicorp	vault	1.17.0 — 1.18.13
hashicorp	vault	1.19.0 — 1.19.8
hashicorp	vault	1.20.0 — 1.20.2

References

Advisories & Patches

https://discuss.hashicorp.com/t/hcsec-2025-20-vault-ldap-mfa-enforcement-bypass-when-using-username-as-alias/76092

Frequently Asked Questions

What is CVE-2025-6013? +

Vault and Vault Enterprise’s (“Vault”) ldap auth method may not have correctly enforced MFA if username_as_alias was set to true and a user had multiple CNs that are equal but with leading or trailing spaces. Fixed in Vault Community Edition 1.20.2 and Vault Enterprise 1.20.2, 1.19.8, 1.18.13, and 1.16.24. It has a CVSS v3.1 base score of 6.5 (MEDIUM).

How severe is CVE-2025-6013? +

CVE-2025-6013 has a CVSS v3.1 score of 6.5 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance.

What products are affected by CVE-2025-6013? +

CVE-2025-6013 affects products from hashicorp, specifically: vault. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2025-6013? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2025-55000 6.5

OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In …

CVE-2025-55001 6.5

OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In …

CVE-2025-6014 6.5

Vault and Vault Enterprise’s (“Vault”) TOTP Secrets Engine code validation endpoint is susceptible to code reuse within its validity period. …

CVE-2025-55127 5.4

HackerOne community member Dao Hoang Anh (yoyomiski) has reported an improper neutralization of whitespace in the username when adding new …

CVE-2024-3817 9.8

HashiCorp’s go-getter library is vulnerable to argument injection when executing Git to discover remote branches. This vulnerability does not affect …

CVE-2025-6000 9.1

A privileged Vault operator within the root namespace with write permission to {{sys/audit}} may obtain code execution on the underlying …

CVE-2025-6013