https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 10:33:57 +0000 https://cve.radiocsirt.org/vuln/bdu:2025-11279 bdu:2025-11279 https://cve.radiocsirt.org/vuln/bdu:2025-11279 https://cve.radiocsirt.org/vuln/bit-openbao-2025-55001 <p><strong>Affected:</strong> Bitnami: openbao</p> <p>OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In versions 2.3.1 and below, OpenBao allowed the assignment of policies and MFA attribution based upon entity aliases, chosen by the underlying auth method. When the username_as_alias=true parameter in the LDAP auth method was in use, the caller-supplied username was used verbatim without normalization, allowing an attacker to bypass alias-specific MFA requirements. This issue was fixed in version 2.3.2. To work around this, remove all usage of the username_as_alias=true parameter and update any entity aliases accordingly.</p> <p><strong>Affected:</strong> Bitnami: openbao</p> <p>OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In versions 2.3.1 and below, OpenBao allowed the assignment of policies and MFA attribution based upon entity aliases, chosen by the underlying auth method. When the username_as_alias=true parameter in the LDAP auth method was in use, the caller-supplied username was used verbatim without normalization, allowing an attacker to bypass alias-specific MFA requirements. This issue was fixed in version 2.3.2. To work around this, remove all usage of the username_as_alias=true parameter and update any entity aliases accordingly.</p> https://cve.radiocsirt.org/vuln/bit-openbao-2025-55001 https://cve.radiocsirt.org/vuln/cnvd-2025-18598 cnvd-2025-18598 https://cve.radiocsirt.org/vuln/cnvd-2025-18598 https://cve.radiocsirt.org/vuln/euvd-2026-249400 EUVD-2026-249400 https://cve.radiocsirt.org/vuln/euvd-2026-249400 https://cve.radiocsirt.org/vuln/fkie_cve-2025-55001 <p>OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In versions 2.3.1 and below, OpenBao allowed the assignment of policies and MFA attribution based upon entity aliases, chosen by the underlying auth method. When the username_as_alias=true parameter in the LDAP auth method was in use, the caller-supplied username was used verbatim without normalization, allowing an attacker to bypass alias-specific MFA requirements. This issue was fixed in version 2.3.2. To work around this, remove all usage of the username_as_alias=true parameter and update any entity aliases accordingly.</p> <p>OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In versions 2.3.1 and below, OpenBao allowed the assignment of policies and MFA attribution based upon entity aliases, chosen by the underlying auth method. When the username_as_alias=true parameter in the LDAP auth method was in use, the caller-supplied username was used verbatim without normalization, allowing an attacker to bypass alias-specific MFA requirements. This issue was fixed in version 2.3.2. To work around this, remove all usage of the username_as_alias=true parameter and update any entity aliases accordingly.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-55001 https://cve.radiocsirt.org/vuln/ghsa-2q8q-8fgw-9p6p <p><strong>Affected:</strong> Go: github.com/openbao/openbao</p> <p>### Impact</p> <p>OpenBao allows assignment of policies and MFA attribution based upon entity aliases, chosen by the underlying auth method. When using the `username_as_alias=true` parameter in the LDAP auth method, the caller-supplied username is used verbatim without normalization, allowing an attacker to bypass alias-specific MFA requirements.</p> <p>### Patches</p> <p>OpenBao v2.3.2 will patch this issue.</p> <p>### Workarounds</p> <p>LDAP methods are only vulnerable if using `username_as_alias=true`. Remove all usage of this parameter and update any entity aliases accordingly.</p> <p>### References</p> <p>This issue was disclosed to HashiCorp and is the OpenBao equivalent of the following tickets:</p> <p>- https://discuss.hashicorp.com/t/hcsec-2025-20-vault-ldap-mfa-enforcement-bypass-when-using-username-as-alias/76092 - https://nvd.nist.gov/vuln/detail/CVE-2025-6013</p> <p><strong>Affected:</strong> Go: github.com/openbao/openbao</p> <p>### Impact</p> <p>OpenBao allows assignment of policies and MFA attribution based upon entity aliases, chosen by the underlying auth method. When using the `username_as_alias=true` parameter in the LDAP auth method, the caller-supplied username is used verbatim without normalization, allowing an attacker to bypass alias-specific MFA requirements.</p> <p>### Patches</p> <p>OpenBao v2.3.2 will patch this issue.</p> <p>### Workarounds</p> <p>LDAP methods are only vulnerable if using `username_as_alias=true`. Remove all usage of this parameter and update any entity aliases accordingly.</p> <p>### References</p> <p>This issue was disclosed to HashiCorp and is the OpenBao equivalent of the following tickets:</p> <p>- https://discuss.hashicorp.com/t/hcsec-2025-20-vault-ldap-mfa-enforcement-bypass-when-using-username-as-alias/76092 - https://nvd.nist.gov/vuln/detail/CVE-2025-6013</p> https://cve.radiocsirt.org/vuln/ghsa-2q8q-8fgw-9p6p https://cve.radiocsirt.org/vuln/opensuse-su-2025:15434-1 <p>govulncheck-vulndb-0.0.20250811T192933-1.1 on GA media</p> <p>govulncheck-vulndb-0.0.20250811T192933-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2025:15434-1 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-1855 <p>Ein entfernter, authentisierter oder anonymer Angreifer kann mehrere Schwachstellen in OpenBao ausnutzen, um beliebigen Code auszuführen, Root-Rechte zu erlangen, Sicherheitsmaßnahmen zu umgehen und vertrauliche Informationen offenzulegen.</p> <p>Ein entfernter, authentisierter oder anonymer Angreifer kann mehrere Schwachstellen in OpenBao ausnutzen, um beliebigen Code auszuführen, Root-Rechte zu erlangen, Sicherheitsmaßnahmen zu umgehen und vertrauliche Informationen offenzulegen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2025-1855