CVE-2025-55003: OpenBao MFA Authentication Bypass Vulnerability

CVE-2025-55003 Overview

OpenBao is an open-source secrets management platform used to store and distribute credentials, certificates, and keys. CVE-2025-55003 affects the Login Multi-Factor Authentication (MFA) subsystem in OpenBao versions 2.3.1 and earlier. The underlying Time-based One Time Password (TOTP) library normalizes user-submitted codes by stripping whitespace. Attackers can append or prepend whitespace to a valid TOTP code to bypass the internal rate limiter that prevents reuse of previously validated codes. This weakness maps to [CWE-307: Improper Restriction of Excessive Authentication Attempts]. The issue was corrected in version 2.3.2.

Critical Impact
An authenticated attacker with a valid TOTP code can reuse it repeatedly within its validity window, defeating a core assumption of MFA replay protection.

Affected Products

OpenBao versions 2.3.1 and earlier
OpenBao Login MFA subsystem with TOTP enforcement enabled
Deployments relying on OpenBao MFA method rate limiting for replay protection

Discovery Timeline

2025-08-09 - CVE-2025-55003 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-55003

Vulnerability Analysis

OpenBao enforces Login MFA by validating a TOTP code submitted alongside primary authentication. To prevent an attacker from replaying an intercepted code within its 30-second validity window, OpenBao tracks previously used codes and rejects duplicates. The rate-limiting logic keys off the raw code string submitted by the client. The TOTP verification library, however, normalizes the input by trimming whitespace before performing the cryptographic comparison. This inconsistency creates a validation-versus-storage mismatch. A code such as 123456, 123456 , and 123456 all pass TOTP verification but are treated as distinct entries by the reuse tracker.

Root Cause

The root cause is inconsistent canonicalization between the reuse-tracking layer and the TOTP validation layer. The reuse cache stores the exact submitted string, while the validator strips whitespace before checking the code. Because the two components disagree on what constitutes the same code, the anti-replay control fails to detect reuse. The fix in commit 8340a6918f6c41d8f75b6c3845c376d9dc32ed19 aligns credential handling and introduces a defined ErrBadMFACredentials error path for consistent MFA rejection.

Attack Vector

Exploitation requires network access to the OpenBao login endpoint and knowledge of one valid TOTP code, for example one captured through shoulder surfing, phishing, or a leaked authenticator screenshot. The attacker submits the code with varying whitespace padding to produce many accepted authentications from a single OTP within its short validity window. User interaction is required because a valid current OTP must be obtained from the legitimate user.

// Security patch in vault/login_mfa.go
// Source: https://github.com/openbao/openbao/commit/8340a6918f6c41d8f75b6c3845c376d9dc32ed19
	mfaLoginEnforcementPrefix = "login-mfa/enforcement/"
)

var ErrBadMFACredentials = errors.New("MFA credentials not supplied or incorrect")

type totpKey struct {
	Key string `json:"key"`
}

The accompanying changelog entry states: auth/mfa: correctly limit reuse of TOTP codes during login MFA enforcement.

Detection Methods for CVE-2025-55003

Indicators of Compromise

Multiple successful MFA validations for the same user within a single 30-second TOTP window
Login MFA submissions containing leading or trailing whitespace in the passcode field
Repeated successful login-mfa audit events sharing an identical or near-identical timestamp cluster

Detection Strategies

Parse OpenBao audit logs for MFA validation events grouped by user and TOTP interval, and alert when more than one success occurs per interval
Inspect request bodies at an API gateway or reverse proxy for MFA passcode values containing whitespace characters
Correlate MFA success events with source IP diversity to identify code reuse from multiple hosts

Monitoring Recommendations

Enable OpenBao audit device logging for all authentication paths, including sys/mfa/* endpoints
Forward audit logs to a centralized analytics platform and build baselines for per-user MFA validation frequency
Track rate-limit quota rejections to detect brute-force attempts against MFA endpoints

How to Mitigate CVE-2025-55003

Immediate Actions Required

Upgrade all OpenBao servers to version 2.3.2 or later
Configure rate-limiting quotas on MFA login paths to constrain abuse until upgrades complete
Rotate any credentials suspected of exposure through MFA replay and review recent login audit events

Patch Information

The fix is delivered in OpenBao 2.3.2 via commit 8340a6918f6c41d8f75b6c3845c376d9dc32ed19. The patch introduces ErrBadMFACredentials and corrects reuse tracking so that whitespace-normalized codes are treated as identical for rate-limiting purposes. Full details are in the GitHub Security Advisory GHSA-rxp7-9q75-vj3p and the HashiCorp Security Discussion HCSEC-2025-19.

Workarounds

Apply strict rate-limit quotas to the sys/mfa/validate and login endpoints to cap MFA attempts per source and per user
Terminate TLS at a proxy that rejects or normalizes MFA passcode fields containing whitespace before forwarding to OpenBao
Reduce TOTP validity windows and disable MFA method reuse tolerance where configurable

bash

# Configuration example: apply a rate-limit quota to MFA validation
bao write sys/quotas/rate-limit/mfa-validate \
    path="sys/mfa/validate" \
    rate=5 \
    interval="1m" \
    block_interval="5m"