CVE-2025-55001

Name of the Vulnerable Software and Affected Versions OpenBao versions 2.3.1 and below

Description OpenBao allows the assignment of policies and MFA attribution based on entity aliases. When the username as alias=true parameter in the LDAP auth method is used, the supplied username is used without normalization, potentially allowing an attacker to bypass alias-specific MFA requirements.

Recommendations OpenBao versions prior to 2.3.2: Remove all usage of the username as alias=true parameter and update any entity aliases accordingly.