Timing Side Channel Vulnerability in Vault and Vault Enterprise
CVE-2025-6011
3.7LOW
What is CVE-2025-6011?
A timing side channel vulnerability in Vault and Vault Enterprise's userpass authentication method enables attackers to differentiate between existing and non-existing users. This exploit allows potential enumeration of valid usernames, posing security risks to user account integrity. Prompt updates are necessary to mitigate this issue, with fixes provided in Vault Community Edition 1.20.1 and various versions of Vault Enterprise.
Affected Version(s)
Vault 64 bit 0 < 1.20.1
Vault Enterprise 64 bit 0 < 1.20.1