CVE-2025-6004CWE-307

Vault Userpass and LDAP User Lockout Bypass

Medium · published August 1, 2025

CVSS v3.1
5.3
EPSS
0%
Percentile
37.8
In the wild
Unconfirmed
What it is

Vault and Vault Enterprise’s (“Vault”) user lockout feature could be bypassed for Userpass and LDAP authentication methods. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00446 · 37.8th percentile
Weakness
CWE-307 · Improper Restriction of Excessive Authentication Attempts
Published
2025-08-01T17:56Z
EPSS history
Timeline
  • 01 AUG 17:56Z
    Vault Userpass and LDAP User Lockout Bypass
    cvelistv5