3.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-6011

CVE-2025-6011: Hashicorp Vault has an Observable Discrepancy on Existing and Non-Existing Users

A timing side channel in Vault and Vault Enterprise’s (“Vault”) userpass auth method allowed an attacker to distinguish between existing and non-existing users, and potentially enumerate valid usernames for Vault’s Userpass auth method. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-6011

CVE-2025-6011:

3.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/hashicorp/vault	go	< 1.20.1	1.20.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

A timing side-channel vulnerability in Hashicorp Vault's userpass authentication method allows attackers to enumerate valid usernames. This vulnerability, CVE-2025-6011, exists because of a flaw in how Vault handles login attempts for non-existent users.

When a login attempt is made for a username that does not exist, Vault uses a placeholder password to perform a bcrypt comparison. In vulnerable versions, this placeholder was a simple string, which is not a valid bcrypt hash. The bcrypt.CompareHashAndPassword function fails very quickly when given an invalid hash, resulting in a noticeable time difference compared to a login attempt for an existing user with a valid hash. An attacker can exploit this timing difference to determine whether a username exists or not.

The vulnerability was addressed by replacing the placeholder string with a valid, hardcoded bcrypt hash. This ensures that the comparison operation takes a similar amount of time for both existing and non-existing users, thus mitigating the timing side-channel.

The vulnerable function is backend.pathLogin, located in the builtin/credential/userpass/path_login.go file. This function is responsible for handling the userpass login process, including the flawed password comparison for non-existent users.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.