What is GHSA-7rx2-769v-hrwf?

GHSA-7rx2-769v-hrwf is a security advisory published by GitHub Security Advisories with Medium severity. HashiCorp Vault ldap auth method may not have correctly enforced MFA

Which CVE IDs does GHSA-7rx2-769v-hrwf cover?

GHSA-7rx2-769v-hrwf covers the following CVE IDs: CVE-2025-6013. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-7rx2-769v-hrwf?

GHSA-7rx2-769v-hrwf has a CVSS v3 base score of 6.5, published by GitHub Security Advisories.

Which products are affected by GHSA-7rx2-769v-hrwf?

GHSA-7rx2-769v-hrwf affects 1 product, including: go/github.com/hashicorp/vault:\u003c 1.20.2.

GHSA-7rx2-769v-hrwfMediumCVSS 6.5

HashiCorp Vault ldap auth method may not have correctly enforced MFA

Vendor

GitHub Security Advisories

Published

August 6, 2025

Last Modified

August 6, 2025

🔗 CVE IDs covered (1)

CVE-2025-6013 →

📋 Description

Vault and Vault Enterprise’s (“Vault”) ldap auth method may not have correctly enforced MFA if username_as_alias was set to true and a user had multiple CNs that are equal but with leading or trailing spaces. Fixed in Vault Community Edition 1.20.2 and Vault Enterprise 1.20.2, 1.19.8, 1.18.13, and 1.16.24.

🎯 Affected products1

go/github.com/hashicorp/vault:< 1.20.2

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2025-6013
https://discuss.hashicorp.com/t/hcsec-2025-20-vault-ldap-mfa-enforcement-bypass-when-using-username-as-alias/76092
https://github.com/advisories/GHSA-7rx2-769v-hrwf