CVE-2025-6011— Timing Side-Channel in Vault’s Userpass Auth Method
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2025-6011
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Timing Side-Channel in Vault’s Userpass Auth Method
Source: NVD (National Vulnerability Database)
Vulnerability Description
A timing side channel in Vault and Vault Enterprise’s (“Vault”) userpass auth method allowed an attacker to distinguish between existing and non-existing users, and potentially enumerate valid usernames for Vault’s Userpass auth method. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
通过差异性导致的信息暴露
Source: NVD (National Vulnerability Database)
Vulnerability Title
HashiCorp Vault Community Edition和HashiCorp Vault Enterprise 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
HashiCorp Vault Enterprise和HashiCorp Vault Community Edition都是美国HashiCorp公司的产品。HashiCorp Vault Enterprise是一个企业信息归档平台。HashiCorp Vault Community Edition是一款密钥管理工具。 HashiCorp Vault Community Edition 1.20.1之前版本和HashiCorp Vault Enterprise 1.20.1、1.19.7、1.18.12和
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| HashiCorp | Vault | 0 ~ 1.20.1 | - | |
| HashiCorp | Vault Enterprise | 0 ~ 1.20.1 | - |
II. Public POCs for CVE-2025-6011
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-6011
请登录查看更多情报信息。
Same Patch Batch · HashiCorp · 2025-08-01 · 7 CVEs total
| CVE-2025-6000 | 9.1 CRITICAL | Arbitrary Remote Code Execution via Plugin Catalog Abuse |
| CVE-2025-5999 | 7.2 HIGH | Vault Root Namespace Operator May Elevate Token Privileges |
| CVE-2025-6037 | 6.8 MEDIUM | Vault Certificate Auth Method Did Not Validate Common Name For Non-CA Certificates |
| CVE-2025-6014 | 6.5 MEDIUM | Vault TOTP Secrets Engine Code Reuse |
| CVE-2025-6015 | 5.7 MEDIUM | Vault Login MFA Bypass of Rate Limiting and TOTP Code Reuse |
| CVE-2025-6004 | 5.3 MEDIUM | Vault Userpass and LDAP User Lockout Bypass |
IV. Related Vulnerabilities
Same product: Vault
- CVE-2026-5807
Vault Vulnerable to Denial-of-Service via Unauthenticated Ro - CVE-2026-4525
Vault Token Leaked to Backends via Authorization: Bearer Pas - CVE-2026-5052
Vault Vulnerable to Server-Side Request Forgery in ACME Chal - CVE-2026-3605
Vault KVv2 Metadata and Secret Deletion Policy Bypass Denial - CVE-2025-12044
Vault Vulnerable to Denial of Service Due to Rate Limit Regr
Same vendor: HashiCorp
- CVE-2026-7776
Boundary Workers Vulnerable to Denial of Service During TLS - CVE-2026-5807
Vault Vulnerable to Denial-of-Service via Unauthenticated Ro - CVE-2026-4525
Vault Token Leaked to Backends via Authorization: Bearer Pas - CVE-2026-5052
Vault Vulnerable to Server-Side Request Forgery in ACME Chal - CVE-2026-3605
Vault KVv2 Metadata and Secret Deletion Policy Bypass Denial
Same weakness: CWE-203
- CVE-2026-44263
Weblate: Private Translation Enumeration via Screenshot API - CVE-2023-5872
Wago: Vulnerability in Smart Designer Web-Application - CVE-2026-33429
Parse Server: Protected field change detection oracle via Li - CVE-2026-33425
Discourse has inferable private group membership or existenc - CVE-2026-3580
Compiler-induced timing leak in sp_256_get_entry_256_9 on RI
V. Comments for CVE-2025-6011
No comments yet