Vulnerability Description
OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In versions 0.1.0 through 2.3.1, OpenBao's TOTP secrets engine could accept valid codes multiple times rather than strictly-once. This was caused by unexpected normalization in the underlying TOTP library. To work around, ensure that all codes are first normalized before submitting to the OpenBao endpoint. TOTP code verification is a privileged action; only trusted systems should be verifying codes.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Openbao | Openbao | < 2.3.2 |
Related Weaknesses (CWE)
References
- https://discuss.hashicorp.com/t/hcsec-2025-17-vault-totp-secrets-engine-code-reuNot Applicable
- https://github.com/openbao/openbao/commit/183891f8d535d5b6eb3d79fda8200cade6de99Patch
- https://github.com/openbao/openbao/security/advisories/GHSA-f7c3-mhj2-9pvgVendor Advisory
FAQ
What is CVE-2025-55000?
CVE-2025-55000 is a vulnerability with a CVSS score of 6.5 (MEDIUM). OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In versions 0.1.0 through 2.3.1, OpenBao's TOTP secrets engine ...
How severe is CVE-2025-55000?
CVE-2025-55000 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-55000?
Check the references section above for vendor advisories and patch information. Affected products include: Openbao Openbao.