TOTP Code Reuse in OpenBao Software Solution
CVE-2025-55000

6.5MEDIUM

Key Information:

Vendor

Openbao

Status
Openbao
Vendor
CVE Published:
9 August 2025

What is CVE-2025-55000?

The TOTP secrets engine within OpenBao allows for the reuse of valid codes due to unexpected normalization issues in its underlying TOTP library. In affected versions from 0.1.0 to 2.3.1, this flaw enables the same TOTP codes to be accepted multiple times instead of just once as intended. Organizations using OpenBao should ensure that TOTP codes are properly normalized prior to submission to the endpoint and should restrict code verification to trusted systems to mitigate the risk of unauthorized access to sensitive data.

Affected Version(s)

openbao >= 0.1.0, < 2.3.2

References

https://github.com/openbao/openbao/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/openbao/openbao/commit/183891f8d535d5b...
x_refsource_MISC
https://discuss.hashicorp.com/t/hcsec-2025-17-vault-totp-...
x_refsource_MISC

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-55000 : TOTP Code Reuse in OpenBao Software Solution