5.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-6015

CVE-2025-6015: Hashicorp Vault has Login MFA Rate Limit Bypass Vulnerability

Vault and Vault Enterprise’s (“Vault”) login MFA rate limits could be bypassed and TOTP tokens could be reused. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-6015

CVE-2025-6015:

5.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/hashicorp/vault	go	>= 1.10.0, < 1.20.1	1.20.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis of the provided vulnerability information and security patches points to a flaw in the TOTP validation logic within Hashicorp Vault's MFA system. The vulnerability, identified as CVE-2025-6015, allowed for the bypass of rate limiting and the reuse of TOTP tokens.

The investigation focused on the commits between the vulnerable version 1.20.0 and the patched version 1.20.1. The key commit, df0e6bbedd9732c644d73d58beb062768745d73b, directly addresses the issue. The changes in this commit are concentrated in the vault/login_mfa.go file, specifically within the validateTOTP function.

The core of the vulnerability was the absence of a length check on the user-provided TOTP passcode. This oversight made it possible for an attacker who had intercepted a valid TOTP token to reuse it by simply appending extra characters, such as spaces. The system would fail to normalize the input and would perceive the altered token as a new, unique entry, thereby bypassing the security measure designed to prevent token reuse.

The patch rectifies this by adding a strict length check at the beginning of the validateTOTP function. This ensures that any passcode not matching the configured digit length of the TOTP secret is immediately rejected. Additionally, the error message for an already used code was made more generic to prevent attackers from distinguishing between invalid and already-used codes, further hardening the system.

Therefore, the Core.validateTOTP function is identified as the vulnerable function. During an exploit, this function would be present in the runtime profile or stack trace as it is the central point of failure for this specific MFA bypass vulnerability.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.