Pavlos Karakalidis

**Name of the Vulnerable Software and Affected Versions** Vault versions prior to 1.21.0 Vault Enterprise versions prior to 1.21.0, 1.20.5, 1.19.11, and 1.16.27 **Description** The AWS Auth method in Vault and Vault Enterprise may allow authentication bypass if the `bound principal iam` role is identical across multiple AWS accounts or utilizes a wildcard character. This can potentially lead to unauthorized access. **Recommendations** Update Vault to version 1.21.0 or later. Update Vault Enterprise to version 1.21.0, 1.20.5, 1.19.11, or 1.16.27 or later.