CVE-2025-6003Vault LDAP MFA enforcement bypass

What broke

Vault's LDAP auth method did not always enforce the configured MFA step. An attacker who could complete LDAP bind skipped the second factor. Fixed in the VaultFault train. NVD had not confirmed a vector at the time of the original research notes. Treat it as high until your tracker says otherwise.

Why it matters

Vault MFA is how a lot of teams sleep at night on a human-reachable UI. An LDAP MFA bypass is the same class as Blast-RADIUS and SimpleHelp: the second factor is configured, not applied.

What to do

• Upgrade to 1.20.2+.
• Prefer cert or OIDC auth for humans. LDAP+MFA on Vault has now failed this test once.
• Confirm in a staging login that a password-only bind is rejected when MFA is on.

After you patch

A vault compromise is not one credential, it is every credential the vault held or could issue.

• Rotate everything in scope, including secrets the vault issued dynamically during the exposure window, because a lease that was valid then may still be valid now.
• Revoke active leases and tokens, then review the audit device log for reads you cannot attribute to a known workload.
• Rotate the vault's own credentials: unseal or recovery keys, root tokens, and any authentication backend configuration that could be used to re-enter.
• Rotate downstream credentials the vault brokered, cloud roles, database users, and PKI certificates, since the point of the vault is that it can mint them. See secrets rotation and what is secrets management.

Sources

• NVD: CVE-2025-6003
• HCSEC-2025-22 / Cyata