OpenBao TOTP Secrets Engine Code Reuse

Impact OpenBao's TOTP secrets engine could accept valid codes multiple times rather than strictly-once. This was caused by unexpected normalization in the underlying TOTP library. Patches OpenBao v2.3.2 will patch this issue. In patching, codes which were not normalized strictly N numeric digits...

GHSA-F7C3-MHJ2-9PVG OpenBao TOTP Secrets Engine Code Reuse

Impact OpenBao's TOTP secrets engine could accept valid codes multiple times rather than strictly-once. This was caused by unexpected normalization in the underlying TOTP library. Patches OpenBao v2.3.2 will patch this issue. In patching, codes which were not normalized strictly N numeric digits...

OpenBao has a Timing Side-Channel in the Userpass Auth Method

Impact When using OpenBao's userpass auth method, user enumeration was possible due to timing difference between non-existent users and users with stored credentials. This is independent of whether the supplied credentials were valid for the given user. Patches OpenBao v2.3.2 will patch this issu...

GHSA-HH28-H22F-8357 OpenBao has a Timing Side-Channel in the Userpass Auth Method

Impact When using OpenBao's userpass auth method, user enumeration was possible due to timing difference between non-existent users and users with stored credentials. This is independent of whether the supplied credentials were valid for the given user. Patches OpenBao v2.3.2 will patch this issu...

GHSA-J3XV-7FXP-GFHX OpenBao Userpass and LDAP User Lockout Bypass

Impact Attackers could bypass the automatic user lockout mechanisms in the OpenBao Userpass or LDAP auth systems. This was caused by different aliasing between pre-flight and full login request user entity alias attributions. Patches OpenBao v2.3.2 will patch this issue. Workarounds Existing user...

OpenBao Userpass and LDAP User Lockout Bypass

Impact Attackers could bypass the automatic user lockout mechanisms in the OpenBao Userpass or LDAP auth systems. This was caused by different aliasing between pre-flight and full login request user entity alias attributions. Patches OpenBao v2.3.2 will patch this issue. Workarounds Existing user...

Privileged OpenBao Operator May Execute Code on the Underlying Host

Impact Under certain threat models, OpenBao operators with privileged API access may not be system administrators and thus normally lack the ability to update binaries or execute code on the system. Additionally, privileged API operators should be unable to perform TCP connections to arbitrary...

GHSA-XP75-R577-CVHP Privileged OpenBao Operator May Execute Code on the Underlying Host

Impact Under certain threat models, OpenBao operators with privileged API access may not be system administrators and thus normally lack the ability to update binaries or execute code on the system. Additionally, privileged API operators should be unable to perform TCP connections to arbitrary...

GHSA-VF84-MXRQ-CRQC OpenBao Root Namespace Operator May Elevate Token Privileges

Impact Accounts with access to the highly-privileged identity entity system in the root namespace may increase their scope directly to the root policy. While the identity system always allowed adding arbitrary policies, which in turn could contain capability grants on arbitrary paths, the root...

PT-2025-32383

Name of the Vulnerable Software and Affected Versions OpenBao versions 2.3.1 and below Description OpenBao allows the assignment of policies and MFA attribution based on entity aliases. When the username as alias=true parameter in the LDAP auth method is used, the supplied username is used withou...

PT-2025-32380

Name of the Vulnerable Software and Affected Versions OpenBao versions 0.1.0 through 2.3.1 Description Attackers could bypass the automatic user lockout mechanisms in the OpenBao Userpass or LDAP authentication systems. This was caused by different aliasing between pre-flight and full login reque...

PT-2025-32379

Name of the Vulnerable Software and Affected Versions OpenBao versions 2.3.1 and below Description OpenBao is a software solution for managing, storing, and distributing sensitive data. In affected versions, accounts with access to highly-privileged identity entity systems in root namespaces coul...

PT-2025-32382

Name of the Vulnerable Software and Affected Versions OpenBao versions 0.1.0 through 2.3.1 Description OpenBao’s TOTP secrets engine could accept valid Time-based One-Time Password TOTP codes multiple times instead of strictly once. This issue stemmed from unexpected normalization within the...

PT-2025-32384

Name of the Vulnerable Software and Affected Versions OpenBao versions 2.3.1 and below Description OpenBao’s Login Multi-Factor Authentication MFA system, utilizing Time-based One Time Password TOTP, accepted codes containing whitespace due to normalization applied by the underlying TOTP library...

PT-2025-32381

Name of the Vulnerable Software and Affected Versions OpenBao versions 0.1.0 through 2.3.1 Description OpenBao is a software solution designed for managing, storing, and distributing sensitive data, including secrets, certificates, and keys. In versions 0.1.0 through 2.3.1, user enumeration was...

GO-2025-3783 OpenBao allows cancellation of root rekey and recovery rekey operations without authentication in github.com/openbao/openbao

OpenBao allows cancellation of root rekey and recovery rekey operations without authentication in github.com/openbao/openbao...

GO-2025-3780 OpenBao Inserts Sensitive Information into Log File when processing malformed data in github.com/openbao/openbao/sdk

OpenBao Inserts Sensitive Information into Log File when processing malformed data in github.com/openbao/openbao/sdk...

Information Disclosure

github.com/openbao/openbao is vulnerable to information disclosure. The vulnerability is due to improper handling of malformed data, which allows an attacker to potentially access sensitive information through exposed logs...

openbao-2.3.1-1.1 on GA media (moderate)

openbao-2.3.1-1.1 on GA media Announcement ID: openSUSE-SU-2025:15254-1 Rating: moderate Cross-References: CVE-2025-4656 CVE-2025-52893 CVE-2025-52894 Affected Products: openSUSE Tumbleweed An update that solves 3 vulnerabilities can now be installed. Description: These are all security issues...

OpenBao Log Information Disclosure Vulnerability

OpenBao is OpenBao open source a sensitive data management software . Versions of OpenBao prior to 2.3.0 suffer from a log message disclosure vulnerability that is exploited by attackers to disclose sensitive information...