VDB
CVE-2025-6013
CVE-2025-6013
PUBLISHED
Vault and Vault Enterprise’s (“Vault”) ldap auth method may not have correctly enforced MFA if username_as_alias was set to true and a user had multiple CNs that are equal but with leading or trailing spaces. Fixed in Vault Community Edition 1.20.2 and Vault Enterprise 1.20.2, 1.19.8, 1.18.13, and 1.16.24.
EPSS 0.06% · 18.3th percentile
Risk Scores
EPSS Score
0.06%
18.3th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Bitnami | vault | 1.10.0 |
| Bitnami | vault | 1.10.0 |
Timeline
- Aug 5, 2025 CVE Published
- Aug 6, 2025 EPSS Score
- Aug 6, 2025 Coalition ESS Score
- Aug 7, 2025 CVE Updated
- Aug 8, 2025 PoC Published
- Aug 14, 2025 EPSS Score
- Aug 22, 2025 PoC Published
- Aug 23, 2025 EPSS Score
- Aug 26, 2025 Coalition ESS Score
- Aug 31, 2025 EPSS Score
- Sep 9, 2025 EPSS Score
- Sep 17, 2025 EPSS Score