HashiCorp Vault's user lockout feature for Userpass and LDAP authentication methods could be bypassed, allowing an attacker to circumvent restrictions on excessive authentication attempts. This improper restriction of authentication attempts is classified under CWE-307. The vulnerability has a CVSS 3.1 base score of 5.3 (medium severity) with network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality or availability impact, but with low integrity impact. The issue is addressed in specific patched versions of Vault Community and Enterprise editions.

An attacker can bypass the user lockout feature for Userpass and LDAP authentication methods, potentially allowing unlimited authentication attempts. This could facilitate brute force or credential stuffing attacks, impacting the integrity of authentication processes. There is no direct confidentiality or availability impact reported.

Upgrade to Vault Community Edition 1.20.1 or later, or Vault Enterprise editions 1.20.1, 1.19.7, 1.18.12, or 1.16.23 or later where the issue is fixed. No other mitigation or temporary workaround is indicated in the provided data.