CVE-2025-6004: HashiCorp Vault Auth Bypass Vulnerability

CVE-2025-6004 Overview

CVE-2025-6004 affects HashiCorp Vault and Vault Enterprise. The user lockout feature can be bypassed for the Userpass and Lightweight Directory Access Protocol (LDAP) authentication methods. The user lockout mechanism is designed to block authentication attempts after repeated failures, protecting accounts from brute-force attacks [CWE-307]. When bypassed, an attacker can continue submitting credential guesses beyond the configured threshold. HashiCorp addressed the issue in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23.

Critical Impact
Attackers can bypass Vault's user lockout protection and conduct sustained credential-guessing attacks against Userpass and LDAP authentication endpoints without triggering account lockouts.

Affected Products

HashiCorp Vault Community Edition prior to 1.20.1
HashiCorp Vault Enterprise prior to 1.20.1, 1.19.7, 1.18.12, and 1.16.23
Vault deployments using Userpass or LDAP authentication methods

Discovery Timeline

2025-08-01 - CVE-2025-6004 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-6004

Vulnerability Analysis

HashiCorp Vault includes a user lockout feature intended to throttle authentication attempts. After a defined number of failed logins within a lockout window, the affected user is blocked from further authentication attempts for a configured duration. This control mitigates online brute-force and password-spraying attacks against Vault's authentication backends.

In affected versions, the lockout logic does not consistently apply to the Userpass and LDAP authentication methods. As a result, an attacker submitting repeated invalid credentials against these endpoints does not trigger the lockout that would otherwise stop further guesses. The vulnerability maps to [CWE-307] Improper Restriction of Excessive Authentication Attempts.

Exploitation impacts integrity by weakening an authentication control, though it does not directly expose secrets. Successful brute-force outcomes depend on the strength of user credentials and any external rate limiting. Networked adversaries can attempt the bypass without prior authentication or user interaction.

Root Cause

The root cause is a flaw in how Vault tracks failed authentication attempts for the Userpass and LDAP auth backends. The lockout counter or enforcement path does not correctly increment or evaluate under certain conditions, allowing attempts to continue past the configured threshold. See the HashiCorp Security Advisory HCSEC-2025-16 for vendor detail.

Attack Vector

An unauthenticated remote attacker sends repeated authentication requests to the Vault API against a Userpass or LDAP mount. Because the lockout does not engage as expected, the attacker continues iterating credential guesses against known or enumerated usernames. This enables sustained credential-stuffing, password-spraying, or targeted brute-force campaigns against Vault-protected identities.

Detection Methods for CVE-2025-6004

Indicators of Compromise

High volumes of failed login events against Userpass (auth/userpass/login/*) or LDAP (auth/ldap/login/*) endpoints in Vault audit logs
Repeated authentication failures for the same username without a corresponding user-lockout event
Authentication attempts originating from unexpected source IP ranges or during off-hours
Sequential username enumeration patterns across Userpass or LDAP mounts

Detection Strategies

Enable Vault audit devices and forward logs to a central analytics platform for rate and pattern analysis
Alert on failed authentication counts per user exceeding the configured lockout_threshold without lockout enforcement
Correlate Vault authentication failures with upstream LDAP directory failed-bind events
Baseline normal authentication volumes per mount and alert on deviations

Monitoring Recommendations

Monitor the /v1/sys/locked-users endpoint to confirm lockouts are functioning after patching
Track Vault version telemetry across the fleet to confirm remediation coverage
Instrument alerts for repeated 400/403 responses from Userpass and LDAP login paths
Review directory-side account lockout policies to provide defense in depth

How to Mitigate CVE-2025-6004

Immediate Actions Required

Upgrade Vault Community Edition to 1.20.1 or later
Upgrade Vault Enterprise to 1.20.1, 1.19.7, 1.18.12, or 1.16.23 depending on the deployed branch
Audit Userpass and LDAP authentication logs for signs of brute-force activity prior to patching
Rotate credentials for any accounts showing anomalous failed-login volumes

Patch Information

HashiCorp released fixes in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23. Details are published in the HashiCorp Security Advisory HCSEC-2025-16. Apply the patch matching your maintenance branch and restart Vault nodes following HashiCorp's rolling upgrade guidance.

Workarounds

Restrict network access to the Vault API using firewalls, service mesh policies, or private networking so only trusted clients can reach authentication endpoints
Enforce strong password policies and multi-factor authentication on backing LDAP directories to reduce brute-force success probability
Place a rate-limiting proxy or web application firewall in front of Vault to throttle repeated login attempts per source
Consider migrating high-value identities to authentication methods less exposed to credential guessing, such as approle or OIDC, until patching is complete

bash

# Verify Vault version after upgrade
vault version

# Review currently locked users to confirm lockout enforcement
vault read sys/locked-users

# Example lockout configuration for the userpass auth method
vault write sys/auth/userpass/tune \
  user_lockout_threshold=5 \
  user_lockout_duration=15m \
  user_lockout_counter_reset=15m \
  user_lockout_disable=false