https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T16:03:07.986452+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2025-11280 bdu:2025-11280 2026-10-03T16:03:08.068856+00:00 bdu:2025-11280 https://cve.radiocsirt.org/vuln/bit-openbao-2025-55000 BIT-openbao-2025-55000 — OpenBao TOTP Secrets Engine Enables Code Reuse 2026-10-03T16:03:08.068895+00:00

Affected: Bitnami: openbao

OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In versions 0.1.0 through 2.3.1, OpenBao's TOTP secrets engine could accept valid codes multiple times rather than strictly-once. This was caused by unexpected normalization in the underlying TOTP library. To work around, ensure that all codes are first normalized before submitting to the OpenBao endpoint. TOTP code verification is a privileged action; only trusted systems should be verifying codes.

 https://cve.radiocsirt.org/vuln/cnvd-2025-18607 cnvd-2025-18607 2026-10-03T16:03:08.068932+00:00 cnvd-2025-18607 https://cve.radiocsirt.org/vuln/euvd-2026-249399 EUVD-2026-249399 2026-10-03T16:03:08.068946+00:00 EUVD-2026-249399 https://cve.radiocsirt.org/vuln/fkie_cve-2025-55000 fkie_cve-2025-55000 2026-10-03T16:03:08.068957+00:00

OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In versions 0.1.0 through 2.3.1, OpenBao's TOTP secrets engine could accept valid codes multiple times rather than strictly-once. This was caused by unexpected normalization in the underlying TOTP library. To work around, ensure that all codes are first normalized before submitting to the OpenBao endpoint. TOTP code verification is a privileged action; only trusted systems should be verifying codes.

 https://cve.radiocsirt.org/vuln/ghsa-f7c3-mhj2-9pvg GHSA-f7c3-mhj2-9pvg — OpenBao TOTP Secrets Engine Code Reuse 2026-10-03T16:03:08.068981+00:00

Affected: Go: github.com/openbao/openbao

### Impact

OpenBao's TOTP secrets engine could accept valid codes multiple times rather than strictly-once. This was caused by unexpected normalization in the underlying TOTP library.

### Patches

OpenBao v2.3.2 will patch this issue.

In patching, codes which were not normalized (strictly N numeric digits) will now be rejected. This is a potentially breaking change.

### Workarounds

TOTP code verification is a privileged action; only trusted systems should be verifying codes. Ensure that all codes are first normalized before submitting to the OpenBao endpoint.

### References

This issue was disclosed to HashiCorp and is the OpenBao equivalent of the following tickets:

- https://discuss.hashicorp.com/t/hcsec-2025-17-vault-totp-secrets-engine-code-reuse/76036 - https://nvd.nist.gov/vuln/detail/CVE-2025-6014

 https://cve.radiocsirt.org/vuln/opensuse-su-2025:15434-1 openSUSE-SU-2025:15434-1 — govulncheck-vulndb-0.0.20250811T192933-1.1 on GA media 2026-10-03T16:03:08.069012+00:00

govulncheck-vulndb-0.0.20250811T192933-1.1 on GA media

 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-1855 WID-SEC-W-2025-1855 — OpenBao: Mehrere Schwachstellen 2026-10-03T16:03:08.069044+00:00

Ein entfernter, authentisierter oder anonymer Angreifer kann mehrere Schwachstellen in OpenBao ausnutzen, um beliebigen Code auszuführen, Root-Rechte zu erlangen, Sicherheitsmaßnahmen zu umgehen und vertrauliche Informationen offenzulegen.