BIT-OPENBAO-2026-63132 OpenBao's Recovery Mode Vulnerable To Token Leakage via Timing Attack

OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao's handleLogicalRecovery path in http/logical.go compared the highly privileged recovery token with ordinary string equality. A remote unauthenticated attacker able to make repeated recovery mode requests a...

SUSE CVE-2026-63132

OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao's handleLogicalRecovery path in http/logical.go compared the highly privileged recovery token with ordinary string equality. A remote unauthenticated attacker able to make repeated recovery mode requests a...

CVE-2026-63132

A flaw was found in OpenBao, an open source identity-based secrets management system. A remote unauthenticated attacker could exploit a timing attack vulnerability in the handleLogicalRecovery path to infer a highly privileged recovery token. This token could then be used to authorize recovery mo...

CVE-2026-63132

The open source secrets management system OpenBao is vulnerable to a timing attack against its recovery token in versions prior to 2.6.0 . The root cause lies in the handleLogicalRecovery path within http/logical.go, where the system compared the highly privileged recovery token using ordinary st...

CVE-2026-63132 OpenBao's Recovery Mode Vulnerable To Token Leakage via Timing Attack

OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao's handleLogicalRecovery path in http/logical.go compared the highly privileged recovery token with ordinary string equality. A remote unauthenticated attacker able to make repeated recovery mode requests a...

CVE-2026-63132 OpenBao's Recovery Mode Vulnerable To Token Leakage via Timing Attack

OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao's handleLogicalRecovery path in http/logical.go compared the highly privileged recovery token with ordinary string equality. A remote unauthenticated attacker able to make repeated recovery mode requests a...

CVE-2026-63132 OpenBao's Recovery Mode Vulnerable To Token Leakage via Timing Attack

OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao's handleLogicalRecovery path in http/logical.go compared the highly privileged recovery token with ordinary string equality. A remote unauthenticated attacker able to make repeated recovery mode requests a...

CVE-2026-63132: Observable Timing Discrepancy

OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao's handleLogicalRecovery path in http/logical.go compared the highly privileged recovery token with ordinary string equality. A remote unauthenticated attacker able to make repeated recovery mode requests a...

Timing Attack

Overview Affected versions of this package are vulnerable to Timing Attack via the recovery token comparison in handleLogicalRecovery in http/logical.go. An attacker can extract the single recovery token and use it to perform privileged recovery-mode API operations by repeatedly sending candidate...

Timing Attack

Overview github.com/hashicorp/vault/http is an a tool for securely accessing secrets. Affected versions of this package are vulnerable to Timing Attack via the recovery token comparison in handleLogicalRecovery in http/logical.go. An attacker can extract the single recovery token and use it to...

Timing Attack

Overview Affected versions of this package are vulnerable to Timing Attack via the recovery token comparison in handleLogicalRecovery in http/logical.go. An attacker can extract the single recovery token and use it to perform privileged recovery-mode API operations by repeatedly sending candidate...

Timing Attack

Overview Affected versions of this package are vulnerable to Timing Attack via the recovery token comparison in handleLogicalRecovery in http/logical.go. An attacker can extract the single recovery token and use it to perform privileged recovery-mode API operations by repeatedly sending candidate...

PT-2026-97129

Name of the Vulnerable Software and Affected Versions OpenBao versions prior to 2.6.0 Description OpenBao is an identity-based secrets management system. The handleLogicalRecovery function in the http/logical.go file uses ordinary string equality to compare the highly privileged recovery token. A...