CVE-2025-6015Vault login MFA rate-limit bypass and TOTP reuse
What broke
Vault's login MFA rate limits could be bypassed and TOTP codes could be reused, according to NVD, so an attacker holding the first factor could keep guessing or replay a code the user had already entered. Fixed in Vault 1.20.2 and the matching Enterprise releases. It sits alongside the LDAP MFA enforcement bypass in CVE-2025-6013.
Why it matters
TOTP is already the weakest common MFA. Skipping it entirely is an MFA bypass, not a TOTP implementation bug. Anyone who put Vault's UI on a VPN and called it "MFA protected" needs to revisit that sentence.
What to do
- Upgrade. Then test a login with a wrong TOTP and a missing TOTP. Both must fail.
- Move human Vault access to phishing-resistant MFA or remove human access and use machine auth.
After you patch
A vault compromise is not one credential, it is every credential the vault held or could issue.
- Rotate everything in scope, including secrets the vault issued dynamically during the exposure window, because a lease that was valid then may still be valid now.
- Revoke active leases and tokens, then review the audit device log for reads you cannot attribute to a known workload.
- Rotate the vault's own credentials: unseal or recovery keys, root tokens, and any authentication backend configuration that could be used to re-enter.
- Rotate downstream credentials the vault brokered, cloud roles, database users, and PKI certificates, since the point of the vault is that it can mint them. See secrets rotation and what is secrets management.
Sources
Related identity CVEs
Related on Start with Identity
- CVEHashiCorp Vault LDAP auth username enumeration
Vault's LDAP auth method returned different errors for unknown and known users. Enumeration is how a lockout or MFA-bypass chain starts. Fixed in 1.14.1 and the
- CVEVaultFault, first public HashiCorp Vault RCE
Vault's plugin catalog and audit-log handling combined into remote code execution. Cyata, Black Hat USA 2025. A flaw about nine years old. CVSS 9.1. Fixed in Va
- Comparisonakeyless-vs-hashicorp-vault
Vault scores 4.4 to Akeyless's 4.3. Vault is the broadest platform if you can run it and accept BUSL under IBM; Akeyless is the managed alternative with a Vault
- Comparisonaws-secrets-manager-vs-hashicorp-vault
AWS Secrets Manager costs 0.40 dollars per secret per month with nothing to run. Vault has dynamic secrets everywhere and no public price, and you have to opera
- ComparisonHashiCorp Vault vs AWS Secrets Manager vs Doppler
Vault vs AWS Secrets Manager vs Doppler in 2026: IBM's dynamic secrets, AWS at $0.40 per secret a month, Doppler at $21 per user. Pricing, sync and who wins.
- CVEVault certificate-auth impersonation, public key not CN
Vault's cert auth method bound the entity to the validated public key, not the certificate CN. An attacker who can present a different cert with a reused key im