CVE-2025-55001 - CVE House
Back to Database
Status published Medium CVE-2025-55001

OpenBao LDAP MFA Enforcement Bypass When Using Username As Alias

Vulnerability Description

OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In versions 2.3.1 and below, OpenBao allowed the assignment of policies and MFA attribution based upon entity aliases, chosen by the underlying auth method. When the username_as_alias=true parameter in the LDAP auth method was in use, the caller-supplied username was used verbatim without normalization, allowing an attacker to bypass alias-specific MFA requirements. This issue was fixed in version 2.3.2. To work around this, remove all usage of the username_as_alias=true parameter and update any entity aliases accordingly.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-55001

Credits & Attribution

No credits recorded in the NVD database.

References

More from openbao

View All →
CVE-2025-64761
OpenBao Privileged Operator Identity Group Root Escalation
High 7.5
CVE-2025-62705
OpenBao and Vault Leak []byte Fields in Audit Logs
Medium 5.7
CVE-2025-62513
OpenBao leaks HTTPRawBody in Audit Logs
Medium 5.7
CVE-2025-59048
OpenBao AWS Plugin Vulnerable to Cross-Account IAM Role Impersonation in AWS Auth Method
High 8.1
CVE-2025-59043
OpenBao vulnerable to denial of service via malicious JSON request processing
High 7.5

Affected Vendor

Affected Software

openbao
Vulnerable Versions:
< 2.3.2

Timeline

Official Publish: August 9th, 2025
Last Modified: August 11th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Weaknesses (CWE)

CWE-156

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.