CVE-2025-55000

Name of the Vulnerable Software and Affected Versions OpenBao versions 0.1.0 through 2.3.1

Description OpenBao’s TOTP secrets engine could accept valid Time-based One-Time Password (TOTP) codes multiple times instead of strictly once. This issue stemmed from unexpected normalization within the underlying TOTP library. TOTP code verification is a privileged action and should only be performed by trusted systems.

Recommendations Versions prior to 2.3.2 are affected. Ensure all codes are normalized before submitting to the OpenBao endpoint.