MEDIUM🇵🇱 Wersja polska

CVE-2025-55000

CVSS 6.5v3.1pub. 2025-08-09upd. 2025-11-13

OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In versions 0.1.0 through 2.3.1, OpenBao's TOTP secrets engine could accept valid codes multiple times rather than strictly-once. This was caused by unexpected normalization in the underlying TOTP library. To work around, ensure that all codes are first normalized before submitting to the OpenBao endpoint. TOTP code verification is a privileged action; only trusted systems should be verifying codes.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

  • Openbao

    APP
    Openbao
    < 2.3.2
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2026-33758CRITICAL9.4PL ✓ten sam produkt

XSS w OpenBao — kradzież tokenu Web UI przez parametr error_description

CVE-2026-33757CRITICAL9.6PL ✓ten sam produkt

OpenBao: zdalne phishing przez JWT/OIDC bez potwierdzenia logowania

CVE-2025-54997CRITICAL9.1PL ✓ten sam produkt

OpenBao: ominięcie restrykcji przez subsystem audytu — RCE i dostęp sieciowy

CVE-2025-64761HIGH7.5ten sam produkt

OpenBao is an open source identity-based secrets management system. Prior to version 2.4.4, a privileged opera...

CVE-2025-59043HIGH7.5ten sam produkt

OpenBao is an open source identity-based secrets management system. In OpenBao versions prior to 2.4.1, JSON o...