PT-2025-31678

CVE-2025-6004

Published

2025-08-01

Updated

2025-10-01

Description by

CVSS 3.1

5.3

Medium

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Vault versions prior to 1.20.1 Vault Enterprise versions prior to 1.20.1, 1.19.7, 1.18.12, and 1.16.23

Description The user lockout feature in Vault and Vault Enterprise could be bypassed for Userpass and LDAP authentication methods.

Recommendations Update to Vault Community Edition version 1.20.1 or later. Update to Vault Enterprise version 1.20.1, 1.19.7, 1.18.12, or 1.16.23 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Yarden Porat

Vendors

Affected products

Weakness enumeration

CWE-307: Improper Restriction of Excessive Authentication Attempts

Related identifiers

CVE-2025-6004