OpenBao: Timing Side-Channel in Userpass Auth Method (CVE-2025-54999)

OpenBao, a software for managing sensitive data, had a timing side-channel vulnerability in its userpass authentication method in versions 0.1.0 through 2.3.1. This vulnerability allowed attackers to enumerate valid users by measuring timing differences in authentication responses between non-existent and existing users, independent of credential correctness. The vulnerability was addressed and fixed in version 2.3.2. As a workaround, users may switch to other authentication methods or implement rate limiting to reduce the risk of exploitation.

The vulnerability enables user enumeration via timing analysis, potentially aiding attackers in identifying valid usernames. This does not directly compromise credentials or data but can facilitate further targeted attacks. There are no known exploits in the wild. The impact is considered low severity.

A fix is available in OpenBao version 2.3.2. Users should upgrade to this version to fully remediate the issue. Alternatively, users can mitigate risk by using other authentication methods or applying rate limiting quotas to limit the number of authentication requests over time. No additional urgent actions are required if the fix is applied or mitigations are in place.