CVE-2026-92738

Name of the Vulnerable Software and Affected Versions Vault Community Edition versions prior to 2.2.2 Vault Enterprise versions prior to 2.2.2 Vault Enterprise versions prior to 1.21.14 Vault Enterprise versions prior to 1.19.26

Description The Login MFA feature does not consistently enforce the lifetime of pending two-phase login requests. This allows a user who has completed the first authentication factor to complete the MFA process and obtain a token even after the pending request should have expired, including instances where the user's primary credential has been rotated.

Recommendations Update Vault Community Edition to version 2.2.2. Update Vault Enterprise to version 2.2.2, 1.21.14, or 1.19.26.