CVE-2025-54998

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In versions 0.1.0 through 2.3.1, attackers could bypass the automatic user lockout mechanisms in the OpenBao Userpass or LDAP auth systems. This was caused by different aliasing between pre-flight and full login request user entity alias attributions. This is fixed in version 2.3.2. To work around this issue, existing users may apply rate-limiting quotas on the authentication endpoints:, see https://openbao.org/api-docs/system/rate-limit-quotas/.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-307

Affected software

No affected versions have been published.

Timeline

Published: Aug 9, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-549993.7OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In CVE-2025-55005.3A flaw has been found in ZhenShi Mibro Fit App 1.6.3.17499 on Android. This impacts an unknown function of the file AndroidManifest.xml of t CVE-2025-550006.5OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In CVE-2025-550016.5OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In CVE-2025-550035.7OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In CVE-2025-550044.3ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-1, ImageMagick is vuln CVE-2025-550055.5ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-1, when preparing to t CVE-2025-550068.8Frappe Learning is a learning system that helps users structure their content. In versions 2.33.0 and below, the image upload functionality CVE-2025-550075.3Knowage is an open source analytics and business intelligence suite. Prior to version 8.1.37, Knowage is vulnerable to server-side request f CVE-2025-550087.1The AuthKit library for React Router 7+ provides helpers for authentication and session management using WorkOS & AuthKit with React Router.CVE-2025-550097.1The AuthKit library for Remix provides convenient helpers for authentication and session management using WorkOS & AuthKit with Remix. In ve CVE-2025-55015.3A vulnerability classified as problematic was found in Open5GS up to 2.7.3. Affected by this vulnerability is the function ngap_handle_path_