CVE-2025-6011CWE-203

Timing Side-Channel in Vault’s Userpass Auth Method

Low · published August 1, 2025

CVSS v3.1
3.7
EPSS
0%
Percentile
28.1
In the wild
Unconfirmed
What it is

A timing side channel in Vault and Vault Enterprise’s (“Vault”) userpass auth method allowed an attacker to distinguish between existing and non-existing users, and potentially enumerate valid usernames for Vault’s Userpass auth method. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23.

The record
Technical detail
CVSS v3.1
3.7 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00356 · 28.1th percentile
Weakness
CWE-203 · Observable Discrepancy
Published
2025-08-01T18:00Z
EPSS history
Timeline
  • 01 AUG 18:00Z
    Timing Side-Channel in Vault’s Userpass Auth Method
    cvelistv5