CVE-2020-16250

HighCVSS 8.2/10Last modified Jun 17, 2026

Description

HashiCorp Vault and Vault Enterprise versions 0.7.1 and newer, when configured with the AWS IAM auth method, may be vulnerable to authentication bypass. Fixed in 1.2.5, 1.3.8, 1.4.4, and 1.5.1..

Metrics

CVSS 3.1 8.2/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

Weakness enumeration

CWE-290 CWE-345

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/159478/Hashicorp-Vault-AWS-IAM-Integration-Authentication-Bypass.htmlThird Party Advisory, VDB Entry
https://github.com/hashicorp/vault/blob/master/CHANGELOG.md#151Release Notes, Vendor Advisory
https://www.hashicorp.com/blog/category/vault/Product, Vendor Advisory
http://packetstormsecurity.com/files/159478/Hashicorp-Vault-AWS-IAM-Integration-Authentication-Bypass.htmlThird Party Advisory, VDB Entry
https://github.com/hashicorp/vault/blob/master/CHANGELOG.md#151Release Notes, Vendor Advisory
https://www.hashicorp.com/blog/category/vault/Product, Vendor Advisory

Timeline

Published: Aug 26, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-162518.2HashiCorp Vault and Vault Enterprise versions 0.8.3 and newer, when configured with the GCP GCE auth method, may be vulnerable to authentica CVE-2020-162524.3The Field Test gem 0.2.0 through 0.3.2 for Ruby allows CSRF.CVE-2020-162538.1The PgHero gem through 2.6.0 for Ruby allows CSRF.CVE-2020-162546.1The Chartkick gem through 3.3.2 for Ruby allows Cascading Style Sheets (CSS) Injection (without attribute).CVE-2020-162556.1ownCloud (Core) before 10.5 allows XSS in login page 'forgot password.'CVE-2020-162568.8The API on Winston 1.5.4 devices is vulnerable to CSRF.CVE-2020-162579.8Winston 1.5.4 devices are vulnerable to command injection via the API.CVE-2020-162587.1Winston 1.5.4 devices make use of a Monit service (not managed during the normal user process) which is configured with default credentials.CVE-2020-162599.8Winston 1.5.4 devices have an SSH user account with access from bastion hosts. This is undocumented in device documents and is not announced CVE-2020-16267.5A vulnerability in Juniper Networks Junos OS Evolved may allow an attacker to cause a Denial of Service (DoS) by sending a high rate of spec CVE-2020-162607.5Winston 1.5.4 devices do not enforce authorization. This is exploitable from the intranet, and can be combined with other vulnerabilities fo CVE-2020-162616.8Winston 1.5.4 devices allow a U-Boot interrupt, resulting in local root access.