{"cve":"CVE-2025-55003","nvd":{"published":"2025-08-09T03:15:47.030","modified":"2026-06-17T09:41:05.757","status":"Analyzed","description":"OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In versions 2.3.1 and below, OpenBao's Login Multi-Factor Authentication (MFA) system allows enforcing MFA using Time-based One Time Password (TOTP). Due to normalization applied by the underlying TOTP library, codes were accepted which could contain whitespace; this whitespace could bypass internal rate limiting of the MFA method and allow reuse of existing MFA codes. This issue was fixed in version 2.3.2. To work around this, use of rate-limiting quotas can limit an attacker's ability to exploit this: https://openbao.org/api-docs/system/rate-limit-quotas/.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","score":5.7},"cwes":["CWE-307"],"references":["https://discuss.hashicorp.com/t/hcsec-2025-19-vault-login-mfa-bypass-of-rate-limiting-and-totp-token-reuse/76038","https://github.com/openbao/openbao/commit/8340a6918f6c41d8f75b6c3845c376d9dc32ed19","https://github.com/openbao/openbao/security/advisories/GHSA-rxp7-9q75-vj3p"],"products":["openbao:openbao"],"source":"nvd","synced_at":"2026-10-19T22:06:45.861874017+00:00"},"epss":{"cve":"CVE-2025-55003","score":0.00268,"percentile":0.18968,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-rxp7-9q75-vj3p","url":"https://osv.dev/vulnerability/GHSA-rxp7-9q75-vj3p","summary":"OpenBao Login MFA Bypass of Rate Limiting and TOTP Token Reuse","modified":"2026-07-27T09:11:27.064288826Z","packages":[{"ecosystem":"Go","name":"github.com/openbao/openbao","purl":"pkg:golang/github.com/openbao/openbao","ranges":[">=0.1.0 <2.3.2"],"fixed":["2.3.2"]},{"ecosystem":"Go","name":"github.com/openbao/openbao","purl":"pkg:golang/github.com/openbao/openbao","ranges":["<0.0.0-20250807113757-8340a6918f6c"],"fixed":["0.0.0-20250807113757-8340a6918f6c"]}]},{"id":"GO-2025-3856","url":"https://osv.dev/vulnerability/GO-2025-3856","summary":"OpenBao Login MFA Bypass of Rate Limiting and TOTP Token Reuse in github.com/openbao/openbao","modified":"2026-07-27T09:11:27.064288826Z","packages":[{"ecosystem":"Go","name":"github.com/openbao/openbao","purl":"pkg:golang/github.com/openbao/openbao","ranges":["<0.0.0-20250807113757-8340a6918f6c",">=0.1.0"],"fixed":["0.0.0-20250807113757-8340a6918f6c"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}