CVE-2025-6011

LOW

HashiCorp Vault < 1.20.1 and 1.16.23 - Timing Side Channel in Userpass Auth Method

Title source: llm

Description

A timing side channel in Vault and Vault Enterprise’s (“Vault”) userpass auth method allowed an attacker to distinguish between existing and non-existing users, and potentially enumerate valid usernames for Vault’s Userpass auth method. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23.

References (1)

Core 1

Core References

Vendor Advisory

https://discuss.hashicorp.com/t/hcsec-2025-15-timing-side-channel-in-vault-s-userpass-auth-method/76034

Scores

CVSS v3 3.7

EPSS 0.0031

EPSS Percentile 22.1%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-203

Status published

Products (4)

hashicorp/vault 1.20.0

hashicorp/vault < 1.16.23

hashicorp/vault < 1.20.1

hashicorp/vault 0 - 1.20.1Go

Published Aug 01, 2025

Tracked Since Feb 18, 2026