CVE-2025-6014: Vault TOTP Secrets Engine Code Reuse
Vault and Vault Enterprise’s (“Vault”) TOTP Secrets Engine code validation endpoint is susceptible to code reuse within its validity period. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/hashicorp/vaultto a version that resolves this vulnerability.Fixed in 1.20.1 - Upgrade
Upgrade
HashiCorp Vault (Community Edition/Enterprise)to a version that resolves this vulnerability.Fixed in 1.16.23 - Upgrade
Upgrade
HashiCorp Vault (Community Edition/Enterprise)to a version that resolves this vulnerability.Fixed in 1.18.12 - Upgrade
Upgrade
HashiCorp Vault (Community Edition/Enterprise)to a version that resolves this vulnerability.Fixed in 1.19.7 - Upgrade
Upgrade
HashiCorp Vault (Community Edition/Enterprise)to a version that resolves this vulnerability.Fixed in 1.20.1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-6014?
CVE-2025-6014 has been rated as a high severity vulnerability due to its potential for code reuse within its validity period.
How do I fix CVE-2025-6014?
To fix CVE-2025-6014, update to Vault Community Edition 1.20.1 or Vault Enterprise versions 1.20.1, 1.19.7, 1.18.12, or 1.16.23.
Which versions of HashiCorp Vault are affected by CVE-2025-6014?
CVE-2025-6014 affects Vault Community Edition versions below 1.20.1 and Vault Enterprise versions between 1.16.23 and 1.20.1.
What are the implications of CVE-2025-6014 for users of HashiCorp Vault?
Users of HashiCorp Vault may experience unauthorized access to sensitive TOTP secrets due to code reuse vulnerability.
Are there any workarounds for CVE-2025-6014 if I cannot update my Vault version?
There are no official workarounds available for CVE-2025-6014; updating to the patched versions is the recommended action.