UpHeron
All vulnerabilities

Servers and applications

CVE-2025-54999

Timing Side-Channel in OpenBao’s Userpass Auth Method

Severity
Low 3.7
Published
8 Aug 2025
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
2.3.2
Also known as
GHSA-hh28-h22f-8357
Sources
NVD, Project advisories (GitHub)

Description

OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In versions 0.1.0 through 2.3.1, when using OpenBao's userpass auth method, user enumeration was possible due to timing difference between non-existent users and users with stored credentials. This is independent of whether the supplied credentials were valid…

Affected software

SoftwareAffected versions
OpenBaoServers and applications · cpe:a:openbao:openbao
  • Every version before 2.3.2
OpenBaoServers and applications · github:openbao/openbao
  • Every version before 2.3.2

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-54999
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-54999
  • GitHub Advisory Database https://github.com/advisories/GHSA-hh28-h22f-8357
  • github.com https://github.com/openbao/openbao/security/advisories/GHSA-hh28-h22f-8357