CVE-2025-6015: HashiCorp Vault MFA Bypass Vulnerability

CVE-2025-6015 Overview

CVE-2025-6015 affects HashiCorp Vault and Vault Enterprise. Authenticated users can bypass login multi-factor authentication (MFA) rate limits and reuse Time-based One-Time Password (TOTP) tokens during the login flow. The flaw maps to [CWE-307: Improper Restriction of Excessive Authentication Attempts]. HashiCorp addressed the issue in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23. The vulnerability is tracked under HashiCorp advisory HCSEC-2025-19.

Critical Impact
Attackers with valid primary credentials can brute-force TOTP codes or replay a captured token, weakening the second authentication factor that protects secrets managed by Vault.

Affected Products

HashiCorp Vault Community Edition prior to 1.20.1
HashiCorp Vault Enterprise prior to 1.20.1, 1.19.7, 1.18.12, and 1.16.23
Vault deployments using login MFA with TOTP method enforcement

Discovery Timeline

2025-08-01 - CVE-2025-6015 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-6015

Vulnerability Analysis

HashiCorp Vault enforces login MFA to add a second factor on top of an authentication method such as userpass, LDAP, or OIDC. The login MFA subsystem applies rate limiting to prevent attackers from guessing TOTP codes and marks used TOTP passcodes as consumed to prevent replay. In affected releases, both controls can be bypassed during the login MFA challenge.

An attacker who already holds valid primary credentials can submit repeated MFA validation attempts beyond the intended threshold. The attacker can also present a previously observed TOTP passcode within its validity window and have Vault accept it again. Successful exploitation grants a Vault token bound to the compromised user's policies, exposing any secrets that user can read.

Root Cause

The defect sits in the login MFA validation path, where the rate-limit counter and the TOTP token replay-cache checks are not consistently applied for every login MFA request. Because of this gap, the authentication throttle described by [CWE-307] does not function as designed, and a used TOTP value is not always invalidated after first acceptance.

Attack Vector

Exploitation requires network access to the Vault API and valid credentials for the primary authentication method, along with user interaction to complete the login. An attacker with a stolen password can iterate through TOTP values until a valid code is found, or replay a code captured through phishing, a compromised endpoint, or a shoulder-surfing scenario. The impact is limited to confidentiality of secrets accessible to the compromised identity.

No public proof-of-concept or exploit code is available. See the HashiCorp advisory HCSEC-2025-19 for vendor technical details.

Detection Methods for CVE-2025-6015

Indicators of Compromise

Repeated login-mfa/validate requests for the same user identifier within a short window in Vault audit logs.
Multiple accepted logins that reference the same TOTP passcode value or MFA request identifier.
Successful token issuance immediately following a burst of failed MFA validation attempts.

Detection Strategies

Parse Vault audit device output and alert when MFA validation attempts for a single entity exceed the expected per-minute threshold.
Correlate primary authentication success with the count of MFA validation attempts to identify guessing behavior.
Compare mfa_request_id and passcode reuse across sessions to surface replayed TOTP values.

Monitoring Recommendations

Forward Vault audit logs to a centralized logging or SIEM platform and retain them long enough to investigate slow guessing campaigns.
Track token issuance by authentication method and alert on anomalous spikes tied to accounts with login MFA enforcement.
Monitor upstream identity providers for credential stuffing that would precede MFA bypass attempts against Vault.

How to Mitigate CVE-2025-6015

Immediate Actions Required

Upgrade Vault Community Edition to 1.20.1 or later.
Upgrade Vault Enterprise to 1.20.1, 1.19.7, 1.18.12, or 1.16.23 depending on the maintained release train.
Rotate credentials and revoke active tokens for any account suspected of MFA bypass activity.
Review audit logs for repeated MFA validation attempts or reused TOTP passcodes since the affected versions were deployed.

Patch Information

HashiCorp fixed CVE-2025-6015 in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23. Details and downloads are described in the HashiCorp advisory HCSEC-2025-19.

Workarounds

Restrict network access to the Vault API to trusted administrative networks until patches are applied.
Enforce strong, unique primary credentials and rotate any that may be exposed, since exploitation requires valid primary authentication.
Where feasible, require additional MFA methods (for example, Okta or Duo push) alongside or instead of TOTP during the upgrade window.

bash

# Configuration example: verify Vault version after patching
vault version
# Expected: Vault v1.20.1 (or a patched Enterprise release: 1.19.7, 1.18.12, 1.16.23)

# Review MFA-related audit events for reuse or brute-force patterns
jq 'select(.request.path | test("sys/mfa|login-mfa"))' /var/log/vault/audit.log