CVE-2025-55001 Details
Description
OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In versions 2.3.1 and below, OpenBao allowed the assignment of policies and MFA attribution based upon entity aliases, chosen by the underlying auth method. When the username_as_alias=true parameter in the LDAP auth method was in use, the caller-supplied username was used verbatim without normalization, allowing an attacker to bypass alias-specific MFA requirements. This issue was fixed in version 2.3.2. To work around this, remove all usage of the username_as_alias=true parameter and update any entity aliases accordingly.
A vulnerability exists in OpenBao's LDAP authentication method, allowing for a bypass of multi-factor authentication (MFA) requirements. This issue is present in OpenBao versions prior to 2.3.2. The vulnerability arises when the 'username_as_alias=true' parameter is used, as it allows an attacker to submit usernames with leading or trailing spaces. These spaces are not normalized, leading to inconsistencies in MFA enforcement. Exploitation can occur by taking advantage of this aliasing method to skip MFA requirements that are normally tied to specific entity aliases.
Users should update to OpenBao version 2.3.2 or later. If an immediate update is not possible, remove the 'username_as_alias=true' parameter from the LDAP authentication configuration and update any affected entity aliases.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Aug 11, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-156 | Improper Neutralization of Whitespace | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| openbao openbao | < 2.3.2 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Aug 12, 2025 | Initial Analysis | [email protected] |
| Aug 9, 2025 | New CVE Received | [email protected] |