CVSS 3.1
5.7 mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:NCVE-2025-6015
Medium (5.7) in hashicorp vault. EPSS 0.4% chance of exploitation in the next 30 days. Fixed in github.com/hashicorp/vault 1.20.1.
Vault and Vault Enterprise’s (“Vault”) login MFA rate limits could be bypassed and TOTP tokens could be reused. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23.
Severity
- EPSS
- 0.4% chance of exploitation in the next 30 days; higher than 28% of CVEs (scores of 2026-10-31)
- CWE
- CWE-307
- Published
- Modified
- Record from
- the NVD, synced
Affected
- hashicorp:vault
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-v6r4-35f9-9rpw | Go | github.com/hashicorp/vault | >=1.10.0 <1.20.1 | 1.20.1 |
| GO-2025-3842 | Go | github.com/hashicorp/vault | >=1.10.0 <1.20.1 | 1.20.1 |