What is GHSA-v6r4-35f9-9rpw?

GHSA-v6r4-35f9-9rpw is a security advisory published by GitHub Security Advisories with Medium severity. Hashicorp Vault has Login MFA Rate Limit Bypass Vulnerability

Which CVE IDs does GHSA-v6r4-35f9-9rpw cover?

GHSA-v6r4-35f9-9rpw covers the following CVE IDs: CVE-2025-6015. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-v6r4-35f9-9rpw?

GHSA-v6r4-35f9-9rpw has a CVSS v3 base score of 5.7, published by GitHub Security Advisories.

Which products are affected by GHSA-v6r4-35f9-9rpw?

GHSA-v6r4-35f9-9rpw affects 1 product, including: go/github.com/hashicorp/vault:\u003e= 1.10.0, \u003c 1.20.1.

GHSA-v6r4-35f9-9rpwMediumCVSS 5.7

Hashicorp Vault has Login MFA Rate Limit Bypass Vulnerability

Vendor

GitHub Security Advisories

Published

August 1, 2025

Last Modified

August 1, 2025

🔗 CVE IDs covered (1)

CVE-2025-6015 →

📋 Description

Vault and Vault Enterprise’s (“Vault”) login MFA rate limits could be bypassed and TOTP tokens could be reused. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23.

🎯 Affected products1

go/github.com/hashicorp/vault:>= 1.10.0, < 1.20.1

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2025-6015
https://discuss.hashicorp.com/t/hcsec-2025-19-vault-login-mfa-bypass-of-rate-limiting-and-totp-token-reuse/76038
https://github.com/advisories/GHSA-v6r4-35f9-9rpw