CVE-2025-55000: OpenBao TOTP Secrets Engine Code Reuse
6.5
Basic Information
GoTechnical Details
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/openbao/openbao | go | >= 0.1.0, < 2.3.2 | 2.3.2 |
| github.com/openbao/openbao | go | < 0.0.0-20250806193153-183891f8d535 | 0.0.0-20250806193153-183891f8d535 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The analysis of the security advisory and the associated commit 183891f8d535d5b6eb3d79fda8200cade6de99e1 clearly indicates that the vulnerability is located in the TOTP code validation path. The commit message explicitly states that the underlying TOTP library transparently removes whitespace, while OpenBao's own code reuse cache did not. This created a loophole where codes with whitespace could bypass the replay attack prevention.
The patch addresses this by adding a strict validation check in the backend.pathValidateCode function within builtin/logical/totp/path_code.go. The new code, strings.TrimSpace(code) != code, ensures that any submitted code containing leading or trailing whitespace is rejected before it can be processed by the TOTP library or checked against the used-code cache. This change effectively closes the reuse vulnerability. Therefore, the backend.pathValidateCode function is the precise location of the vulnerability and the function that would appear in a runtime profile during exploitation.