HCSEC-2026-59 - Expired Vault login MFA requests may remain redeemable

Bulletin ID: HCSEC-2026-59 Affected Products / Versions: Vault and Vault Enterprise 1.10.0 up to 2.2.1; fixed in Vault 2.2.2 and Vault Enterprise 2.2.2, 1.21.14, and 1.19.26. Publication Date: November 13, 2026 Summary Vault’s Login MFA feature did not consistently enforce the lifetime of pending two-phase login requests. This may allow a user who previously completed the first authentication factor to complete MFA and obtain a Vault token after the pending request should have expired, including after the user’s primary credential has been rotated. This vulnerability (CVE-2026-92738) is fixed in Vault Community Edition 2.2.2 and Vault Enterprise 2.2.2, 1.21.14, and 1.19.26. Background Vault’s Login MFA feature supports a two-phase login, in which a client first authenticates to an auth method and then completes a second factor, such as a TOTP passcode or a Duo, Okta, or PingID push, in a separate request. Between the two phases, Vault holds the result of the first-factor authentication in memory as a pending login request. Pending login requests are intended to remain valid for five minutes, after which the first factor must be repeated. Details Vault relied on a periodic background process to remove expired pending login requests, and did not check whether a pending request had expired when it was completed. Because this process removed expired requests at a limited rate, a backlog of older pending requests could delay removal of a later expired request, allowing it to be completed after its intended lifetime. An attacker who had completed the first factor, retained the resulting pending login request, and could still satisfy the configured second factor may have been able to obtain a new Vault token after the user’s primary credential had been rotated. The length of this extension depends on the size of the backlog, which an authenticated user could increase through repeated first-factor logins. This issue does not bypass the second factor. Single-phase Lo…