CVE-2024-5798 - CVE House
Back to Database
Status published Low CVE-2024-5798

Vault Incorrectly Validated JSON Web Tokens (JWT) Audience Claims

Vulnerability Description

Vault and Vault Enterprise did not properly validate the JSON Web Token (JWT) role-bound audience claim when using the Vault JWT auth method. This may have resulted in Vault validating a JWT the audience and role-bound claims do not match, allowing an invalid login to succeed when it should have been rejected. This vulnerability, CVE-2024-5798, was fixed in Vault and Vault Enterprise 1.17.0, 1.16.3, and 1.15.9

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-5798

Credits & Attribution

No credits recorded in the NVD database.

References

More from HashiCorp

View All →
CVE-2025-8959
HashiCorp go-getter Vulnerable to Arbitrary Read through Symlink Attack
High 7.5
CVE-2025-6203
Vault unauthenticated denial of service through complex json payload
High 7.5
CVE-2025-6037
Vault Certificate Auth Method Did Not Validate Common Name For Non-CA Certificates
Medium 6.8
CVE-2025-6015
Vault Login MFA Bypass of Rate Limiting and TOTP Code Reuse
Medium 5.7
CVE-2025-6014
Vault TOTP Secrets Engine Code Reuse
Medium 6.5

Affected Vendor

Affected Software

Vault, Vault Enterprise
Vulnerable Versions:
0.11.0

Timeline

Official Publish: June 12th, 2024
Last Modified: November 4th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:N/A:N

Weaknesses (CWE)

CWE-287

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1078 Valid Accounts
Persistence
T1556 Modify Authentication Process
Credential Access