Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2025-6004

Vault and Vault Enterprise’s (“Vault”) user lockout feature could be bypassed for Userpass and LDAP authentication methods. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23.

Published

2025-08-01T18:15:56.570

Last Modified

2025-08-13T18:10:19.797

Status

Analyzed

Source

[email protected]

Severity

CVSSv3.1: 5.3 (MEDIUM)

Weaknesses
  • Type: Secondary
    CWE-307
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application hashicorp vault < 1.16.23 Yes
Application hashicorp vault < 1.20.1 Yes
Application hashicorp vault < 1.18.12 Yes
Application hashicorp vault < 1.19.7 Yes
Application hashicorp vault 1.20.0 Yes
References