CVE-2026-92738

HashiCorp Vault 's Login MFA feature fails to consistently enforce the lifetime of pending two-phase login requests. This allows a user who completed the first authentication factor to finish the MFA process and obtain a Vault token even after the request should have expired, including after prim...