CVE-2025-55001mediumCWE-156

CVE-2025-55001: medium-severity vulnerability in openbao

OpenBao LDAP MFA Enforcement Bypass When Using Username As Alias

Published · Updated

Follow this CVE+ Monitor openbao+ Monitor github.com/openbao/openbao

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.5epss 0.2%
In short

OpenBao's LDAP authentication allows attackers to bypass multi-factor authentication (MFA) requirements by manipulating usernames when a specific setting is enabled. An attacker can use a crafted username to skip MFA checks that should be enforced.

Technical detail

When LDAP auth method uses username_as_alias=true, user-supplied usernames are not normalized before being used as entity aliases for policy and MFA enforcement. This allows attackers to bypass alias-specific MFA requirements by supplying alternate username formats. The vulnerability exists in OpenBao versions 2.3.1 and below, with fixes applied in version 2.3.2.

Summary generated and translated by AI from the official description.
OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In versions 2.3.1 and below, OpenBao allowed the assignment of policies and MFA attribution based upon entity aliases, chosen by the underlying auth method. When the username_as_alias=true parameter in the LDAP auth method was in use, the caller-supplied username was used verbatim without normalization, allowing an attacker to bypass alias-specific MFA requirements. This issue was fixed in version 2.3.2. To work around this, remove all usage of the username_as_alias=true parameter and update any entity aliases accordingly.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Affected products
openbao · openbao
Related CVEs — openbao

In the same product, most dangerous first.

CVE-2025-59043HIGHOpenBao vulnerable to denial of service via malicious JSON request processingEPSS 0.7%CVE-2026-63132CRITICALOpenBao's Recovery Mode Vulnerable To Token Leakage via Timing AttackEPSS 0.6%CVE-2026-46405MEDIUMOpenBao's Kerberos Auth Method Accumulates Unaccessible TokensEPSS 0.6%CVE-2026-55776MEDIUMOpenBao: Transit secrets engine crashes on key creation with `derived: true` for asymmetric key typesEPSS 0.6%CVE-2026-55774LOWOpenBao: Cross-namespace lease revocation/renewal via canonical sys/leases/{revoke,renew} — incomplete fix of CVE-2026-45808EPSS 0.6%CVE-2026-55770MEDIUMOpenBao: LDAPi ldaputil (wrong escape func)EPSS 0.5%