PT-2025-32380
CVE-2025-54998
·
Published
2025-08-08
·
Updated
2026-07-27
Description by
CVSS 3.1
5.3
MediumMetricsAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Name of the Vulnerable Software and Affected Versions
OpenBao versions 0.1.0 through 2.3.1
Description
Attackers could bypass the automatic user lockout mechanisms in the OpenBao Userpass or LDAP authentication systems. This was caused by different aliasing between pre-flight and full login request user entity alias attributions.
Recommendations
Update to version 2.3.2 to resolve this issue.
Apply rate-limiting quotas on the authentication endpoints.
Exploitability
Exploit
Fix
Impacts
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾