6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-6013

CVE-2025-6013: HashiCorp Vault ldap auth method may not have correctly enforced MFA

Vault and Vault Enterprise’s (“Vault”) ldap auth method may not have correctly enforced MFA if username_as_alias was set to true and a user had multiple CNs that are equal but with leading or trailing spaces. Fixed in Vault Community Edition 1.20.2 and Vault Enterprise 1.20.2, 1.19.8, 1.18.13, and 1.16.24.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-6013

CVE-2025-6013:

6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/hashicorp/vault	go	< 1.20.2	1.20.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the LDAP authentication method of HashiCorp Vault when the username_as_alias option is enabled. The root cause is the improper handling of usernames with leading or trailing whitespace. An attacker could authenticate with a username like ' user' instead of 'user', causing Vault to create a new, distinct entity alias. Since MFA policies are tied to the canonical entity alias, this new alias would not have any MFA enforcement, allowing the attacker to bypass the security control.

The patch addresses this by changing how the entity alias is created. Instead of directly using the user-provided username, the patched code now parses the Distinguished Name (DN) returned by the LDAP server upon successful authentication. It extracts the canonical username from the DN and uses that to create the entity alias. This ensures that, regardless of any extra whitespace in the provided username, the same canonical entity alias is always used, and thus the correct MFA policies are always enforced.

The analysis of the patch commit 299306ff4e3657c469e86da459144dda3c627ae8 clearly shows these changes in the backend.Login function within builtin/credential/ldap/backend.go. The backend.pathLogin function in builtin/credential/ldap/path_login.go is the HTTP handler that calls the vulnerable Login function, making it a critical part of the exploitation path.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.