CVE-2025-55000

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In versions 0.1.0 through 2.3.1, OpenBao's TOTP secrets engine could accept valid codes multiple times rather than strictly-once. This was caused by unexpected normalization in the underlying TOTP library. To work around, ensure that all codes are first normalized before submitting to the OpenBao endpoint. TOTP code verification is a privileged action; only trusted systems should be verifying codes.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-156

Affected software

No affected versions have been published.

Timeline

Published: Aug 9, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-550016.5OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In CVE-2025-550035.7OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In CVE-2025-550044.3ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-1, ImageMagick is vuln CVE-2025-550055.5ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-1, when preparing to t CVE-2025-550068.8Frappe Learning is a learning system that helps users structure their content. In versions 2.33.0 and below, the image upload functionality CVE-2025-550075.3Knowage is an open source analytics and business intelligence suite. Prior to version 8.1.37, Knowage is vulnerable to server-side request f CVE-2025-550087.1The AuthKit library for React Router 7+ provides helpers for authentication and session management using WorkOS & AuthKit with React Router.CVE-2025-550097.1The AuthKit library for Remix provides convenient helpers for authentication and session management using WorkOS & AuthKit with Remix. In ve CVE-2025-55015.3A vulnerability classified as problematic was found in Open5GS up to 2.7.3. Affected by this vulnerability is the function ngap_handle_path_CVE-2025-550107.2Kanboard is project management software that focuses on the Kanban methodology. Prior to version 1.2.47, an unsafe deserialization vulnerabi CVE-2025-550115.3Kanboard is project management software that focuses on the Kanban methodology. Prior to version 1.2.47, the createTaskFile method in the AP CVE-2025-550128.5Zed is a multiplayer code editor. Prior to version 0.197.3, in the Zed Agent Panel allowed for an AI agent to achieve Remote Code Execution