Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2025-3879

Vault Community, Vault Enterprise (“Vault”) Azure Auth method did not correctly validate the claims in the Azure-issued token, resulting in the potential bypass of the bound_locations parameter on login. Fixed in Vault Community Edition 1.19.1 and Vault Enterprise 1.19.1, 1.18.7, 1.17.14, 1.16.18.

Published

2025-05-02T17:15:51.273

Last Modified

2025-08-12T01:39:23.767

Status

Analyzed

Source

[email protected]

Severity

CVSSv3.1: 6.6 (MEDIUM)

Weaknesses
  • Type: Secondary
    CWE-863
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application hashicorp vault < 1.16.18 Yes
Application hashicorp vault < 1.19.1 Yes
Application hashicorp vault < 1.17.14 Yes
Application hashicorp vault < 1.18.7 Yes
Application hashicorp vault 1.19.0 Yes
References