CVE-2025-55000: OpenBao TOTP Auth Bypass Vulnerability

CVE-2025-55000 Overview

CVE-2025-55000 affects OpenBao, an open-source secrets management platform used to store and distribute credentials, certificates, and keys. The vulnerability resides in the Time-based One-Time Password (TOTP) secrets engine. Versions 0.1.0 through 2.3.1 accept the same valid TOTP code multiple times instead of enforcing single-use semantics. An underlying TOTP library normalizes submitted codes, allowing attackers to bypass the reuse prevention check by submitting variants of a previously accepted code. The flaw is categorized under CWE-156: Improper Neutralization of Whitespace.

Critical Impact
Authenticated actors with access to the TOTP verification endpoint can replay valid codes, undermining the single-use guarantee that TOTP-based authentication workflows rely on.

Affected Products

OpenBao versions 0.1.0 through 2.3.1
OpenBao TOTP secrets engine (builtin/logical/totp)
Downstream systems that delegate TOTP verification to OpenBao

Discovery Timeline

2025-08-09 - CVE-2025-55000 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-55000

Vulnerability Analysis

OpenBao's TOTP secrets engine is designed to verify a code exactly once, then mark it as consumed to prevent replay. The verification path in builtin/logical/totp/path_code.go failed to normalize submitted codes before comparing them against the store of previously used codes.

The underlying TOTP library, however, applied its own normalization (stripping whitespace) before validating the code numerically. As a result, a code such as 123456 and a whitespace-padded variant like 123 456 both validated successfully, but only one form was recorded as consumed. An attacker able to submit codes to the verification endpoint could therefore reuse a captured code by altering its whitespace, breaking the single-use property of TOTP.

Root Cause

The root cause is inconsistent input normalization between OpenBao's reuse-tracking logic and the third-party TOTP validation library. OpenBao stored the raw submitted string while the library validated a normalized copy, letting equivalent-but-textually-distinct inputs pass the reuse check.

Attack Vector

Exploitation requires network access to the OpenBao API and authenticated privileges to call the TOTP verification endpoint. TOTP verification is itself a privileged action, so the practical risk depends on which systems are permitted to invoke it. An attacker who observes or intercepts a valid code can submit alternate whitespace-padded forms within the code's validity window to authenticate more than once.

// Patch excerpt: builtin/logical/totp/path_code.go
 import (
 	"context"
 	"fmt"
+	"strings"
 	"time"
 
 	"github.com/openbao/openbao/sdk/v2/framework"
// Source: https://github.com/openbao/openbao/commit/183891f8d535d5b6eb3d79fda8200cade6de99e1

The patch imports strings so that the verification path can normalize submitted codes (removing whitespace) before checking them against the used-code store, aligning OpenBao's tracking with the library's validation behavior.

Detection Methods for CVE-2025-55000

Indicators of Compromise

Repeated successful TOTP verification requests for the same numeric code value within a single 30-second window.
TOTP verification requests containing whitespace, tab, or non-digit characters embedded within the code field.
Authentication events for a single identity that originate from divergent source addresses within the TOTP validity window.

Detection Strategies

Parse OpenBao audit logs and normalize the submitted TOTP code (strip whitespace) before grouping by user and time window to identify duplicate successful verifications.
Alert on any TOTP submission whose length exceeds the expected digit count for the configured TOTP profile.
Correlate TOTP verification success events with downstream authorization events to detect multiple sessions established from a single code.

Monitoring Recommendations

Enable OpenBao audit devices and forward request and response records to a centralized logging pipeline for retention and analysis.
Baseline the volume of /totp/code/* verification calls per identity and flag deviations.
Monitor OpenBao version telemetry across the estate to confirm no instances remain on affected releases 0.1.0 through 2.3.1.

How to Mitigate CVE-2025-55000

Immediate Actions Required

Upgrade OpenBao to a release that includes the fix from commit 183891f8d535d5b6eb3d79fda8200cade6de99e1.
Restrict access to the TOTP verification endpoint to trusted systems only, using OpenBao policies and network segmentation.
Review audit logs for prior verification calls containing non-digit characters in the code field.

Patch Information

The fix is committed to OpenBao in commit 183891f and documented in GHSA-f7c3-mhj2-9pvg. Related background is available in the HashiCorp Security Discussion for HCSEC-2025-17. Upgrade to a release beyond 2.3.1 that includes this commit.

Workarounds

Normalize TOTP codes on the client side by stripping whitespace and non-digit characters before submitting them to the OpenBao endpoint.
Reject submitted codes at an API gateway or proxy if they do not match a strict ^[0-9]{6,8}$ pattern.
Limit TOTP verification calls to a single request per identity per 30-second window at a reverse proxy layer.

bash

# Example: enforce strict TOTP code format at an ingress proxy
# Reject requests where the 'code' field contains non-digit characters
if ($request_body ~* "\"code\"\s*:\s*\"[^\"]*[^0-9\"][^\"]*\"") {
    return 400;
}