CVE-2025-6014
📋 TL;DR
The Vault TOTP secrets engine code validation endpoint allows time-based one-time password codes to be reused within their validity period. This affects HashiCorp Vault Community Edition and Vault Enterprise users with TOTP secrets engine enabled. Attackers could potentially bypass TOTP-based multi-factor authentication.
💻 Affected Systems
- HashiCorp Vault Community Edition
- HashiCorp Vault Enterprise
📦 What is this software?
Vault by Hashicorp
Vault by Hashicorp
Vault by Hashicorp
Vault by Hashicorp
Vault by Hashicorp
⚠️ Risk & Real-World Impact
Worst Case
Complete bypass of TOTP-based MFA, allowing unauthorized access to protected resources and secrets.
Likely Case
Limited authentication bypass for specific accounts where attackers can intercept or predict TOTP codes.
If Mitigated
Minimal impact if proper network segmentation, access controls, and monitoring are in place.
🎯 Exploit Status
Requires ability to intercept or obtain valid TOTP codes within their validity window.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Vault Community Edition 1.20.1, Vault Enterprise 1.20.1, 1.19.7, 1.18.12, or 1.16.23
Vendor Advisory: https://discuss.hashicorp.com/t/hcsec-2025-17-vault-totp-secrets-engine-code-reuse/76036
Restart Required: No
Instructions:
1. Backup Vault configuration and data. 2. Download appropriate patched version from HashiCorp. 3. Stop Vault service. 4. Replace binary with patched version. 5. Start Vault service. 6. Verify version and functionality.
🔧 Temporary Workarounds
Disable TOTP Secrets Engine
allTemporarily disable TOTP secrets engine if not required
vault secrets disable totp/
Reduce TOTP Validity Period
allConfigure shorter TOTP code validity periods to reduce attack window
vault write totp/config period=30
🧯 If You Can't Patch
- Implement additional authentication factors beyond TOTP
- Monitor authentication logs for suspicious TOTP code reuse patterns
🔍 How to Verify
Check if Vulnerable:
Check Vault version with 'vault version' and verify TOTP secrets engine is enabledCheck Version:
vault versionVerify Fix Applied:
Verify version is patched and test TOTP code validation rejects reused codes📡 Detection & Monitoring
Log Indicators:
- Multiple authentication attempts with same TOTP code
- TOTP validation failures followed by successes
Network Indicators:
- Unusual authentication patterns to TOTP endpoints
SIEM Query:
source="vault" AND "totp" AND ("validation" OR "authentication") | stats count by src_ip, user