CVEvulnerability

CVE-2025-3879

8.8 HIGH Published 2025-05-02 Modified 2026-06-17 Official page ↗
Status
Analyzed
Published
2025-05-02
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.6 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 ([email protected])
8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-863

Description

Vault Community, Vault Enterprise (“Vault”) Azure Auth method did not correctly validate the claims in the Azure-issued token, resulting in the potential bypass of the bound_locations parameter on login. Fixed in Vault Community Edition 1.19.1 and Vault Enterprise 1.19.1, 1.18.7, 1.17.14, 1.16.18.

Affected configurations

• hashicorp vault (>= 0.10.0 < 1.16.18) • hashicorp vault (>= 0.10.0 < 1.19.1) • hashicorp vault (>= 1.17.0 < 1.17.14) • hashicorp vault (>= 1.18.0 < 1.18.7) • hashicorp vault 1.19.0

Related

Weakness · CWE (1)

  • CWE-863 Incorrect Authorization weakness

References