CVE-2025-6014: vault — Fix

Description

Vault and Vault Enterprise’s (“Vault”) TOTP Secrets Engine code validation endpoint is susceptible to code reuse within its validity period. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23.

Is your site exposed to CVE-2025-6014?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

6.5

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness Type (CWE)

CWE-156 CWE-156

Affected Products

Vendor	Product	Versions
hashicorp	vault	< 1.16.23
hashicorp	vault	< 1.20.1
hashicorp	vault	1.17.0 — 1.18.12
hashicorp	vault	1.19.0 — 1.19.7
hashicorp	vault	All

References

Advisories & Patches

https://discuss.hashicorp.com/t/hcsec-2025-17-vault-totp-secrets-engine-code-reuse/76036

Frequently Asked Questions

What is CVE-2025-6014? +

Vault and Vault Enterprise’s (“Vault”) TOTP Secrets Engine code validation endpoint is susceptible to code reuse within its validity period. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23. It has a CVSS v3.1 base score of 6.5 (MEDIUM).

How severe is CVE-2025-6014? +

CVE-2025-6014 has a CVSS v3.1 score of 6.5 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance.

What products are affected by CVE-2025-6014? +

CVE-2025-6014 affects products from hashicorp, specifically: vault. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2025-6014? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2025-6013 6.5

Vault and Vault Enterprise’s (“Vault”) ldap auth method may not have correctly enforced MFA if username_as_alias was set to true …

CVE-2025-55000 6.5

OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In …

CVE-2025-55001 6.5

OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In …

CVE-2025-55127 5.4

HackerOne community member Dao Hoang Anh (yoyomiski) has reported an improper neutralization of whitespace in the username when adding new …

CVE-2024-3817 9.8

HashiCorp’s go-getter library is vulnerable to argument injection when executing Git to discover remote branches. This vulnerability does not affect …

CVE-2025-6000 9.1

A privileged Vault operator within the root namespace with write permission to {{sys/audit}} may obtain code execution on the underlying …

CVE-2025-6014