UpHeron
All vulnerabilities

Servers and applications

CVE-2025-54998

OpenBao Userpass and LDAP User Lockout Bypass

Severity
Medium 5.3
Published
8 Aug 2025
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
2.3.2
Also known as
GHSA-j3xv-7fxp-gfhx
Sources
NVD, Project advisories (GitHub)

Description

OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In versions 0.1.0 through 2.3.1, attackers could bypass the automatic user lockout mechanisms in the OpenBao Userpass or LDAP auth systems. This was caused by different aliasing between pre-flight and full login request user entity alias attributions. This is…

Affected software

SoftwareAffected versions
OpenBaoServers and applications · cpe:a:openbao:openbao
  • Every version before 2.3.2
OpenBaoServers and applications · github:openbao/openbao
  • Every version before 2.3.2

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-54998
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-54998
  • GitHub Advisory Database https://github.com/advisories/GHSA-j3xv-7fxp-gfhx
  • github.com https://github.com/openbao/openbao/security/advisories/GHSA-j3xv-7fxp-gfhx