Medium severity5.3NVD Advisory· Published Aug 1, 2025· Updated Jun 17, 2026
CVE-2025-6004
CVE-2025-6004
Description
Vault and Vault Enterprise’s (“Vault”) user lockout feature could be bypassed for Userpass and LDAP authentication methods. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/hashicorp/vaultGo | >= 1.13.0, < 1.20.1 | 1.20.1 |
Affected products
14- osv-coords9 versionspkg:apk/chainguard/splunk-otel-collectorpkg:apk/chainguard/splunk-otel-collector-fipspkg:apk/wolfi/splunk-otel-collectorpkg:bitnami/vaultpkg:golang/github.com/hashicorp/vaultpkg:rpm/opensuse/govulncheck-vulndb&distro=openSUSE%20Leap%2015.6pkg:rpm/opensuse/govulncheck-vulndb&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/openbao&distro=openSUSE%20Tumbleweedpkg:rpm/suse/govulncheck-vulndb&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Package%20Hub%2015%20SP6
< 0.138.0-r0+ 8 more
- (no CPE)range: < 0.138.0-r0
- (no CPE)range: < 0.138.0-r1
- (no CPE)range: < 0.138.0-r0
- (no CPE)range: >= 1.13.0, < 1.20.1
- (no CPE)range: >= 1.13.0, < 1.20.1
- (no CPE)range: < 0.0.20250814T182633-150000.1.98.1
- (no CPE)range: < 0.0.20250811T192933-1.1
- (no CPE)range: < 2.3.2-1.1
- (no CPE)range: < 0.0.20250814T182633-150000.1.98.1
- Range: 1.13.0
Patches
Vulnerability mechanics
References
3- discuss.hashicorp.com/t/hcsec-2025-16-vault-userpass-and-ldap-user-lockout-bypass/76035nvdVendor AdvisoryWEB
- github.com/advisories/GHSA-qgj7-fmq2-6cc4ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2025-6004ghsaADVISORY
News mentions
0No linked articles in our index yet.