GitHub Advisoryadvisory · Go

GHSA-qv3p-fmv3-9hww Hashicorp Vault's TOTP Secrets Engine Susceptible to Code Reuse

MEDIUM Published 2025-08-01 Modified 2025-08-01 Official page ↗
Aliases
CVE-2025-6014
Ecosystem
Go
Packages
github.com/hashicorp/vault
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-156
Reviewed
2025-08-01

Affected packages

• Go github.com/hashicorp/vault: < 1.20.1 → fixed in 1.20.1

Description

Vault and Vault Enterprise’s (“Vault”) TOTP Secrets Engine code validation endpoint is susceptible to code reuse within its validity period. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23.

Related

Alias · CVE (1)

  • CVE-2025-6014 Vault and Vault Enterprise’s (“Vault”) TOTP Secrets Engine code validation endpoint is susceptible to code reuse within its validity period. vulnerability

Weakness · CWE (1)

  • CWE-156 Improper Neutralization of Whitespace weakness

References