CVE-2025-6014: Hashicorp Vault's TOTP Secrets Engine Susceptible to Code Reuse

The vulnerability exists in the TOTP secrets engine of Hashicorp Vault, where the code validation logic did not properly handle whitespace, allowing for TOTP code reuse. The root cause was the lack of input validation on the length of the TOTP code provided by the user. An attacker could exploit this by taking a valid TOTP code and appending whitespace characters to it. Since the server was not stripping the whitespace before checking for reuse, the modified code was treated as a new, valid code. The fix was to add a strict length check on the input code to ensure it matches the expected length of the TOTP code, preventing any manipulation with whitespace. The vulnerable function is backend.handleValidate in builtin/logical/totp/path_code.go, which is responsible for this validation.