5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-54998

CVE-2025-54998: OpenBao Userpass and LDAP User Lockout Bypass

Impact

Attackers could bypass the automatic user lockout mechanisms in the OpenBao Userpass or LDAP auth systems. This was caused by different aliasing between pre-flight and full login request user entity alias attributions.

Patches

OpenBao v2.3.2 will patch this issue.

Workarounds

Existing users may apply rate-limiting quotas on the authentication endpoints: https://openbao.org/api-docs/system/rate-limit-quotas/

References

This issue was disclosed to HashiCorp and is the OpenBao equivalent of the following tickets:

https://discuss.hashicorp.com/t/hcsec-2025-16-vault-userpass-and-ldap-user-lockout-bypass/76035
https://nvd.nist.gov/vuln/detail/CVE-2025-6004

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-54998

CVE-2025-54998:

5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/openbao/openbao	go	>= 0.1.0, < 2.3.2	2.3.2
github.com/openbao/openbao	go	< 0.0.0-20250807212521-c52795c1ef74	0.0.0-20250807212521-c52795c1ef74

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, identified as CVE-2025-6004, allows an attacker to bypass user lockout mechanisms in OpenBao's LDAP and userpass authentication methods. The root cause is an inconsistency in how user aliases are generated and handled between the initial user lockout check (the 'alias lookahead') and the actual login process.

An attacker could provide a username with variations, such as leading/trailing whitespace or different character casing (e.g., ' user ' or 'User' instead of 'user'). The alias lookahead logic, which is responsible for checking if an account is locked, did not normalize these variations. However, the backend authentication systems (LDAP/userpass) might still resolve these variations to the same user account.

This discrepancy allowed an attacker to repeatedly attempt to log in with these username variations. Each attempt would be seen as a login for a different user by the lockout mechanism, thus never incrementing the failure count for the actual user account and never triggering a lockout.

The patch addresses this by implementing two key changes:

Username Normalization: The pathLoginAliasLookahead and pathLogin functions in both the ldap and userpass auth methods are modified to normalize usernames by trimming whitespace and converting them to lowercase. This ensures that variations of a username are treated as a single identity.
Consistent Alias Propagation: The core request handling logic in vault/request_handling.go is refactored. The user alias information generated during the initial isUserLocked check is now captured and passed consistently throughout the entire login process, including to the failedUserLoginProcess and token creation functions. This guarantees that the same user alias is used for checking the lock status, recording failed attempts, and clearing failed attempts upon a successful login.

By enforcing consistent alias generation and propagation, the patch closes the loophole that allowed the user lockout mechanism to be bypassed.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

5.3

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2025-54998: OpenBao Userpass and LDAP User Lockout Bypass

Impact

Patches

Workarounds

References

CVE-2025-54998:

5.3

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

CVE-2025-54998: OpenBao Userpass and LDAP User Lockout Bypass

Impact

Patches

Workarounds

References

Basic Information

Basic Information

Technical Details

5.3

5.3

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI