CVE-2025-6015CWE-307

Vault Login MFA Bypass of Rate Limiting and TOTP Code Reuse

Medium · published August 1, 2025

CVSS v3.1
5.7
EPSS
0%
Percentile
27.4
In the wild
Unconfirmed
What it is

Vault and Vault Enterprise’s (“Vault”) login MFA rate limits could be bypassed and TOTP tokens could be reused. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23.

The record
Technical detail
CVSS v3.1
5.7 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00350 · 27.4th percentile
Weakness
CWE-307 · Improper Restriction of Excessive Authentication Attempts
Published
2025-08-01T18:03Z
EPSS history
Timeline
  • 01 AUG 18:03Z
    Vault Login MFA Bypass of Rate Limiting and TOTP Code Reuse
    cvelistv5