GitHub Advisoryadvisory · Go

GHSA-f7c3-mhj2-9pvg OpenBao TOTP Secrets Engine Code Reuse

MEDIUM Published 2025-08-08 Modified 2025-08-11 Official page ↗
Aliases
CVE-2025-55000
Ecosystem
Go
Packages
github.com/openbao/openbao
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-156
Reviewed
2025-08-08

Affected packages

• Go github.com/openbao/openbao: >= 0.1.0, < 2.3.2 → fixed in 2.3.2 • Go github.com/openbao/openbao: < 0.0.0-20250806193153-183891f8d535 → fixed in 0.0.0-20250806193153-183891f8d535

Description

Impact OpenBao's TOTP secrets engine could accept valid codes multiple times rather than strictly-once. This was caused by unexpected normalization in the underlying TOTP library. Patches OpenBao v2.3.2 will patch this issue. In patching, codes which were not normalized (strictly N numeric digits) will now be rejected. This is a potentially breaking change. Workarounds TOTP code verification is a privileged action; only trusted systems should be verifying codes. Ensure that all codes are first normalized before submitting to the OpenBao endpoint. References This issue was disclosed to HashiCorp and is the OpenBao equivalent of the following tickets: • https://discuss.hashicorp.com/t/hcsec-2025-17-vault-totp-secrets-engine-code-reuse/76036 • https://nvd.nist.gov/vuln/detail/CVE-2025-6014

Related

Alias · CVE (1)

  • CVE-2025-55000 OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. vulnerability

Weakness · CWE (1)

  • CWE-156 Improper Neutralization of Whitespace weakness

References