CVE-2025-6011

CVE-2025-6011 describes a timing side-channel in Vault and Vault Enterprise's userpass authentication that could let an attacker distinguish existing vs non-existing usernames, enabling possible username enumeration. Root cause: timing differences during user existence checks in the Userpass meth...