CVE-2025-6013Vault TOTP and LDAP EntityID reuse

What broke

Vault could reuse an EntityID across TOTP and LDAP auth methods. The entity you thought was "Alice via LDAP" could become bound to a different login. Fixed in 1.20.2.

Why it matters

EntityID is Vault's internal identity. Reusing it is account merge without consent, the same class as Keycloak First Broker Login. Policies, MFA state, and audit trails attach to the wrong person.

What to do

• Upgrade. Then inspect identity/entity for merges you did not intend.
• Do not share aliases across auth methods unless you have a written reason.

After you patch

A vault compromise is not one credential, it is every credential the vault held or could issue.

• Rotate everything in scope, including secrets the vault issued dynamically during the exposure window, because a lease that was valid then may still be valid now.
• Revoke active leases and tokens, then review the audit device log for reads you cannot attribute to a known workload.
• Rotate the vault's own credentials: unseal or recovery keys, root tokens, and any authentication backend configuration that could be used to re-enter.
• Rotate downstream credentials the vault brokered, cloud roles, database users, and PKI certificates, since the point of the vault is that it can mint them. See secrets rotation and what is secrets management.

Sources

• NVD: CVE-2025-6013