UpHeron
All vulnerabilities

Servers and applications

CVE-2025-55001

OpenBao LDAP MFA Enforcement Bypass When Using Username As Alias

Severity
Medium 6.5
Published
8 Aug 2025
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
2.3.2
Also known as
GHSA-2q8q-8fgw-9p6p
Sources
NVD, Project advisories (GitHub)

Description

OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In versions 2.3.1 and below, OpenBao allowed the assignment of policies and MFA attribution based upon entity aliases, chosen by the underlying auth method. When the username_as_alias=true parameter in the LDAP auth method was in use, the caller-supplied…

Affected software

SoftwareAffected versions
OpenBaoServers and applications · cpe:a:openbao:openbao
  • Every version before 2.3.2
OpenBaoServers and applications · github:openbao/openbao
  • Every version before 2.3.2

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-55001
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-55001
  • GitHub Advisory Database https://github.com/advisories/GHSA-2q8q-8fgw-9p6p
  • github.com https://github.com/openbao/openbao/security/advisories/GHSA-2q8q-8fgw-9p6p