CVE-2025-6016Vault TOTP login MFA bypass

What broke

Vault's TOTP login MFA did not always run. A password (or another first factor) was enough. Fixed in 1.20.2. Like CVE-2025-6003, NVD scoring lagged the vendor/researcher write-up.

Why it matters

TOTP is already the weakest common MFA. Skipping it entirely is an MFA bypass, not a TOTP implementation bug. Anyone who put Vault's UI on a VPN and called it "MFA protected" needs to revisit that sentence.

What to do

• Upgrade. Then test a login with a wrong TOTP and a missing TOTP. Both must fail.
• Move human Vault access to phishing-resistant MFA or remove human access and use machine auth.

After you patch

A vault compromise is not one credential, it is every credential the vault held or could issue.

• Rotate everything in scope, including secrets the vault issued dynamically during the exposure window, because a lease that was valid then may still be valid now.
• Revoke active leases and tokens, then review the audit device log for reads you cannot attribute to a known workload.
• Rotate the vault's own credentials: unseal or recovery keys, root tokens, and any authentication backend configuration that could be used to re-enter.
• Rotate downstream credentials the vault brokered, cloud roles, database users, and PKI certificates, since the point of the vault is that it can mint them. See secrets rotation and what is secrets management.

Sources

• NVD: CVE-2025-6016