Authentication Bypass in HashiCorp Vault's Multi-Factor Authentication Feature
CVE-2026-92738

6.8MEDIUM

Key Information:

Vendor

Hashicorp
Status
Vault
Vault Enterprise
Vendor
CVE Published:
13 November 2026

What is CVE-2026-92738?

The multi-factor authentication (MFA) feature in HashiCorp Vault exhibits a serious flaw whereby it fails to properly enforce the expiration of pending two-phase login requests. This weakness could permit previously authenticated users to complete MFA and obtain a Vault token after the request should have been invalidated, particularly in scenarios where the primary credential has been changed. Prompt upgrades to the specified versions are essential to mitigate the risk associated with this issue.

Affected Version(s)

Vault 64 bit 1.10.0 < 2.2.2

Vault Enterprise 64 bit 1.10.0 < 2.2.2

References

https://discuss.hashicorp.com/t/hcsec-2026-59-expired-vau...

CVSS V3.1

Score:
6.8
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

This issue was identified by an external party who reported it to HashiCorp.
.