OpenBao Userpass and LDAP User Lockout Bypass (CVE-2025-54998)

OpenBao, a software solution for managing sensitive data such as secrets, certificates, and keys, has a vulnerability (CVE-2025-54998) in versions 0.1.0 through 2.3.1. The flaw allows attackers to bypass automatic user lockout mechanisms in both Userpass and LDAP authentication systems because of differing aliasing between pre-flight and full login request user entity alias attributions. This inconsistency prevents the lockout from triggering as intended. The vulnerability is fixed in version 2.3.2. A recommended workaround before patching is to apply rate-limiting quotas on authentication endpoints as documented by the vendor.

Attackers can bypass the automatic user lockout controls designed to prevent brute-force or repeated authentication attempts, potentially allowing unauthorized access attempts to continue without being blocked. This undermines an important security control for protecting user accounts in OpenBao's authentication systems.

A fix is available in OpenBao version 2.3.2 and users should upgrade to this version to remediate the vulnerability. As a temporary mitigation, rate-limiting quotas can be applied to authentication endpoints to reduce the risk of abuse. Refer to the vendor documentation at https://openbao.org/api-docs/system/rate-limit-quotas/ for guidance on configuring rate limits.