OpenBao TOTP Secrets Engine Enables Code Reuse (CVE-2025-55000)

OpenBao is a software solution for managing sensitive data such as secrets, certificates, and keys. In versions from 0.0.1 up to but not including 2.3.2, the TOTP secrets engine does not enforce strict one-time use of valid TOTP codes because of unexpected normalization in the underlying TOTP library. This allows the same valid code to be accepted multiple times, potentially enabling code reuse. The recommended workaround is to normalize all TOTP codes before submitting them to the OpenBao endpoint. The vulnerability has been fixed in version 2.3.2, with a patch available in the OpenBao GitHub repository.

The vulnerability allows reuse of valid TOTP codes, which could weaken the security guarantees of TOTP-based authentication or authorization processes within OpenBao. Since TOTP verification is a privileged action, improper enforcement of single-use codes could lead to unauthorized repeated access or actions if an attacker can reuse codes. However, no known exploits in the wild have been reported.

A patch is available and should be applied by upgrading OpenBao to version 2.3.2 or later. Additionally, ensure that all TOTP codes are normalized before submission to the OpenBao endpoint to work around the issue. Since TOTP verification is privileged, restrict this functionality to trusted systems only.