Home

Description

A timing side channel in Vault and Vault Enterprise’s (“Vault”) userpass auth method allowed an attacker to distinguish between existing and non-existing users, and potentially enumerate valid usernames for Vault’s Userpass auth method. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23.

PUBLISHED Reserved 2025-06-11 | Published 2025-08-01 | Updated 2025-08-01 | Assigner HashiCorp




LOW: 3.7CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Problem types

CWE-203: Observable Discrepancy

Product status

Default status
unaffected

Any version before 1.20.1
affected

Default status
unaffected

Any version before 1.20.1
affected

References

discuss.hashicorp.com/...-vault-s-userpass-auth-method/76034

cve.org (CVE-2025-6011)

nvd.nist.gov (CVE-2025-6011)

Download JSON