CVE-2025-6011

Name of the Vulnerable Software and Affected Versions Vault versions prior to 1.20.1 Vault Enterprise versions prior to 1.20.1 Vault Enterprise version 1.19.7 Vault Enterprise version 1.18.12 Vault Enterprise version 1.16.23

Description A timing side channel in the userpass authentication method allowed an attacker to differentiate between existing and non-existing users, potentially enabling the enumeration of valid usernames.

Recommendations Update Vault to version 1.20.1 or later. Update Vault Enterprise to version 1.20.1 or later. Update Vault Enterprise to version 1.19.7 or later. Update Vault Enterprise to version 1.18.12 or later. Update Vault Enterprise to version 1.16.23 or later.