Machine-written summary
Summary written by Claude Haiku from the source advisory. Not reviewed by a person.
OpenBao versions before 2.3.2 are affected when the LDAP auth method is configured with username_as_alias=true. A caller-supplied username is used without normalization, which lets an attacker bypass alias-specific MFA requirements. Upgrade to OpenBao 2.3.2 or later; if you cannot upgrade, remove username_as_alias=true from LDAP configuration and update entity aliases accordingly.
Not analysed yet
We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.
Severity and exploitation
| Score | Rating | CVSS | Vector | Source |
|---|---|---|---|---|
| 6.5 | Medium | 3.1 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N | CNA (GitHub_M) |
- CISA KEV Not listed.
- EPSS 0.0024, the 15th percentile, on 6 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.
Timeline
- 31 Oct 2026, 14:56 UTC First seen by agentprime
- 31 Oct 2026, 14:56 UTC Confirmed by OSV
Sources
- GitHub Advisory Database: GHSA-2q8q-8fgw-9p6p
- OSV: GHSA-2q8q-8fgw-9p6p
- github.com/openbao/openbao/security/advisories/GHSA-2q8q-8fgw-9p6p
- nvd.nist.gov/vuln/detail/CVE-2025-55001
- nvd.nist.gov/vuln/detail/CVE-2025-6013
- github.com/openbao/openbao/commit/c52795c1ef746c7f2c510f9225aa8ccbbd44f9fc
- discuss.hashicorp.com/t/hcsec-2025-20-vault-ldap-mfa-enforcement-bypass-when-using-username-as-alias/76092
- github.com/openbao/openbao