CVE-2025-6014: HashiCorp Vault Auth Bypass Vulnerability

CVE-2025-6014 Overview

HashiCorp Vault and Vault Enterprise contain a flaw in the Time-based One-Time Password (TOTP) Secrets Engine code validation endpoint. The endpoint accepts the same TOTP code multiple times within its validity window, violating the single-use property that TOTP is designed to enforce [CWE-156]. An authenticated attacker who obtains a valid TOTP code can replay it before expiration to bypass multi-factor verification workflows that depend on Vault's TOTP engine. HashiCorp addressed the issue in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23.

Critical Impact

Authenticated users can reuse valid TOTP codes within their validity period, undermining second-factor authentication guarantees provided by the Vault TOTP Secrets Engine.

Affected Products

• HashiCorp Vault Community Edition versions prior to 1.20.1
• HashiCorp Vault Enterprise versions prior to 1.20.1, 1.19.7, 1.18.12, and 1.16.23
• Vault Enterprise 1.20.0

Discovery Timeline

• 2025-08-01 - CVE-2025-6014 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-6014

Vulnerability Analysis

The Vault TOTP Secrets Engine generates and validates time-based one-time passwords following RFC 6238. The specification requires validators to reject any TOTP code that has already been consumed, even if the code remains within its 30-second validity window. Vault's code validation endpoint failed to enforce this single-use constraint.

An authenticated client with permission to call the validation endpoint can submit the same TOTP code repeatedly during its validity period and receive a successful validation response each time. This weakens any workflow that relies on the engine to enforce one-time semantics, including step-up authentication and transaction approval flows. The flaw is classified under [CWE-156: Improper Neutralization of Whitespace] in the NVD record and reflects a business-logic failure in the engine's replay protection.

Root Cause

The root cause is missing state tracking of previously validated TOTP codes within the engine. The validator checked whether a submitted code matched the current time-step value but did not record or cross-reference prior successful validations. Without a used-code cache or counter, the engine could not distinguish an initial submission from a replay.

Attack Vector

Exploitation requires network access to a Vault instance and authentication with privileges to call the TOTP validation endpoint. An attacker who intercepts or observes a legitimate TOTP code, or an authorized user acting maliciously, can replay the code within the 30-second window. No user interaction is required beyond the attacker's own API call. The flaw affects confidentiality of protected secrets by enabling bypass of second-factor checks that gate privileged operations.

For the vendor's detailed description, see the HashiCorp Security Advisory HCSEC-2025-17.

Detection Methods for CVE-2025-6014

Indicators of Compromise

• Repeated successful calls to the TOTP validation endpoint (/totp/code/<name>) with the same code value within a 30-second window.
• Multiple validation audit events for the same TOTP key and identical response payloads emitted in rapid succession.
• Privileged operations gated by TOTP being approved more than once per code lifetime.

Detection Strategies

• Enable Vault audit devices and parse request logs for repeated validation requests against identical TOTP code values per key.
• Correlate successful TOTP validations with downstream privileged actions to identify anomalous reuse patterns.
• Baseline normal validation volume per TOTP key and alert when counts exceed expected authentication frequency.

Monitoring Recommendations

• Forward Vault audit logs to a centralized analytics platform for query and retention.
• Track the Vault server version in configuration inventory and alert when hosts run versions below the patched releases.
• Monitor authentication workflows that depend on TOTP for unexpected success rates following suspected credential exposure.

How to Mitigate CVE-2025-6014

Immediate Actions Required

• Upgrade Vault Community Edition to 1.20.1 or later.
• Upgrade Vault Enterprise to 1.20.1, 1.19.7, 1.18.12, or 1.16.23 depending on your supported branch.
• Review audit logs for TOTP code reuse since the engine was first deployed.
• Rotate any secrets or approvals that may have been granted based on reused TOTP validations.

Patch Information

HashiCorp released fixes in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23. The patch enforces single-use validation by tracking previously consumed codes within the current time step. Refer to the HashiCorp Security Advisory HCSEC-2025-17 for release notes and upgrade guidance.

Workarounds

• Restrict policies granting access to the TOTP validation endpoint to only the identities that require it.
• Add application-layer replay protection by caching validated codes outside Vault until the upgrade is complete.
• Shorten TOTP validity windows where configurable to reduce the replay opportunity until patched.

# Confirm the running Vault version and plan the upgrade
vault status -format=json | jq '.version'

# Example policy restricting TOTP validation to a specific role
path "totp/code/mfa-admin" {
  capabilities = ["update"]
}