GHSA-HH28-H22F-8357 OpenBao has a Timing Side-Channel in the Userpass Auth Method

🗓️ 08 Aug 2025 14:41:14Reported by GoogleType

osv

osv🔗 osv.dev👁 8 Views

OpenBao timing in userpass auth enables user enumeration patch v2.3.2 workaround: rate limits.

Reporter	Title	Published	Views	Family All 51
AlpineLinux	CVE-2025-54999	9 Aug 202502:00	–	alpinelinux
BDU FSTEC	The vulnerability of the CompareHashAndPassword function in the Vault Enterprise and Vault Community Edition platforms for archiving corporate information allows attackers to gain unauthorized access to protected information due to timing discrepancies.	17 Sep 202500:00	–	bdu_fstec
BDU FSTEC	The vulnerability of OpenBao’s encryption and secret management system, related to the exposure of information through incompatibility, allows attackers to gain access to confidential information.	17 Sep 202500:00	–	bdu_fstec
Chainguard	CVE-2025-6011 vulnerabilities	7 Jan 202601:30	–	cgr
CNNVD	HashiCorp Vault Community Edition和HashiCorp Vault Enterprise 安全漏洞	1 Aug 202500:00	–	cnnvd
CNNVD	OpenBao 安全漏洞	9 Aug 202500:00	–	cnnvd
CNVD	OpenBao has an unspecified vulnerability (CNVD-2025-18600)	15 Aug 202500:00	–	cnvd
CVE	CVE-2025-54999	9 Aug 202502:00	–	cve
CVE	CVE-2025-6011	1 Aug 202518:00	–	cve
Cvelist	CVE-2025-54999 OpenBao: Timing Side-Channel in Userpass Auth Method	9 Aug 202502:00	–	cvelist

Source	Link
github	www.github.com/openbao/openbao/security/advisories/GHSA-hh28-h22f-8357
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-54999
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-6011
github	www.github.com/openbao/openbao/commit/4d9b5d3d6486ab9fbd5b644173fa0097015d6626
discuss	www.discuss.hashicorp.com/t/hcsec-2025-15-timing-side-channel-in-vault-s-userpass-auth-method/76034
discuss	www.discuss.hashicorp.com/t/hcsec-2025-21-vault-user-enumeration-in-userpass-auth-method/76095
github	www.github.com/openbao/openbao

11 Aug 2025 18:42Current

6.3Medium risk

Vulners AI Score6.3

CVSS 3.13.7

EPSS0.0032

timing side channel user enumeration openbao patch rate limits