CVE-2025-6013: 
HashiCorp Vault vulnerability analysis and mitigation

A vulnerability (CVE-2025-6013) was discovered in HashiCorp Vault and Vault Enterprise's LDAP authentication method. The issue affects versions from 1.10.0 up to 1.20.1, where MFA enforcement could be bypassed when usernameasalias was set to true and a user had multiple CNs that are equal but contained leading or trailing spaces. The vulnerability was disclosed on August 6, 2025, and has been assigned a CVSS v3.1 base score of 6.5 (Medium) (HashiCorp Discussion, NVD).

The vulnerability stems from inconsistencies in string normalization when handling LDAP usernames containing additional whitespaces. While these usernames may be valid and authenticate successfully after normalization by the LDAP backend, the Vault LDAP auth method would set the entity alias name using the raw user input rather than the normalized user DN information returned by the LDAP directory. This inconsistency in handling strings with additional spaces resulted in entity alias names and potentially duplicate entity alias IDs, which could lead to MFA enforcement being bypassed. The issue has been classified under CWE-156 (Improper Neutralization of Whitespace) (HashiCorp Discussion).

The vulnerability could allow attackers to bypass Multi-Factor Authentication (MFA) enforcement in specific configurations where usernameasalias is enabled and users have multiple CNs with leading or trailing spaces. This could potentially lead to unauthorized access to protected resources that should require MFA verification (HashiCorp Discussion).

The vulnerability has been fixed in Vault Community Edition 1.20.2 and Vault Enterprise versions 1.20.2, 1.19.8, 1.18.13, and 1.16.24. Organizations are advised to evaluate their risk and upgrade to these patched versions. The fix addresses the string normalization issues in the LDAP authentication method (HashiCorp Discussion).

The vulnerability was responsibly disclosed by Yarden Porat of Cyata Security to HashiCorp, demonstrating effective coordination in vulnerability disclosure practices (HashiCorp Discussion).