CVE-2025-6013Vault TOTP and LDAP EntityID reuse
What broke
Vault could reuse an EntityID across TOTP and LDAP auth methods. The entity you thought was "Alice via LDAP" could become bound to a different login. Fixed in 1.20.2.
Why it matters
EntityID is Vault's internal identity. Reusing it is account merge without consent, the same class as Keycloak First Broker Login. Policies, MFA state, and audit trails attach to the wrong person.
What to do
- Upgrade. Then inspect
identity/entityfor merges you did not intend. - Do not share aliases across auth methods unless you have a written reason.
After you patch
A vault compromise is not one credential, it is every credential the vault held or could issue.
- Rotate everything in scope, including secrets the vault issued dynamically during the exposure window, because a lease that was valid then may still be valid now.
- Revoke active leases and tokens, then review the audit device log for reads you cannot attribute to a known workload.
- Rotate the vault's own credentials: unseal or recovery keys, root tokens, and any authentication backend configuration that could be used to re-enter.
- Rotate downstream credentials the vault brokered, cloud roles, database users, and PKI certificates, since the point of the vault is that it can mint them. See secrets rotation and what is secrets management.
Sources
Related identity CVEs
Related on Start with Identity
- CVEHashiCorp Vault LDAP auth username enumeration
Vault's LDAP auth method returned different errors for unknown and known users. Enumeration is how a lockout or MFA-bypass chain starts. Fixed in 1.14.1 and the
- CVEVault login MFA rate-limit bypass and TOTP reuse
Vault's login MFA rate limits could be bypassed and TOTP codes reused, weakening the second factor. Part of the 2025 VaultFault set with the LDAP MFA bypass in
- CVEVault Userpass and LDAP lockout bypass via username case
Vault treated Userpass and LDAP usernames as case-sensitive for lockout and case-insensitive for login. Case permutation resets the lockout counter and enables
- Comparisonakeyless-vs-hashicorp-vault
Vault scores 4.4 to Akeyless's 4.3. Vault is the broadest platform if you can run it and accept BUSL under IBM; Akeyless is the managed alternative with a Vault
- Comparisonaws-secrets-manager-vs-hashicorp-vault
AWS Secrets Manager costs 0.40 dollars per secret per month with nothing to run. Vault has dynamic secrets everywhere and no public price, and you have to opera
- ComparisonHashiCorp Vault vs AWS Secrets Manager vs Doppler
Vault vs AWS Secrets Manager vs Doppler in 2026: IBM's dynamic secrets, AWS at $0.40 per secret a month, Doppler at $21 per user. Pricing, sync and who wins.