CVE-2025-55001: OpenBao LDAP MFA Enforcement Bypass When Using Username As Alias
Impact
OpenBao allows assignment of policies and MFA attribution based upon entity aliases, chosen by the underlying auth method. When using the usernameasalias=true parameter in the LDAP auth method, the caller-supplied username is used verbatim without normalization, allowing an attacker to bypass alias-specific MFA requirements.
Patches
OpenBao v2.3.2 will patch this issue.
Workarounds
LDAP methods are only vulnerable if using usernameasalias=true. Remove all usage of this parameter and update any entity aliases accordingly.
References
This issue was disclosed to HashiCorp and is the OpenBao equivalent of the following tickets:
- https://discuss.hashicorp.com/t/hcsec-2025-20-vault-ldap-mfa-enforcement-bypass-when-using-username-as-alias/76092 - https://nvd.nist.gov/vuln/detail/CVE-2025-6013
Other sources
OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In versions 2.3.1 and below, OpenBao allowed the assignment of policies and MFA attribution based upon entity aliases, chosen by the underlying auth method. When the usernameasalias=true parameter in the LDAP auth method was in use, the caller-supplied username was used verbatim without normalization, allowing an attacker to bypass alias-specific MFA requirements. This issue was fixed in version 2.3.2. To work around this, remove all usage of the usernameasalias=true parameter and update any entity aliases accordingly.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-55001?
CVE-2025-55001 is considered to have a high severity due to its potential impact on authentication and access control.
How do I fix CVE-2025-55001?
To fix CVE-2025-55001, upgrade to OpenBao version 2.3.2 or the specific remedy version 0.0.0-20250807212521-c52795c1ef74.
What are the consequences of exploiting CVE-2025-55001?
Exploitation of CVE-2025-55001 can lead to unauthorized access due to the lack of normalization of caller-supplied usernames.
What versions of OpenBao are affected by CVE-2025-55001?
OpenBao versions from 0.1.0 up to, but not including, 2.3.2 are affected by CVE-2025-55001.
What methods of authentication does CVE-2025-55001 involve?
CVE-2025-55001 specifically involves the LDAP authentication method with the parameter 'username_as_alias=true'.