Vault and Vault Enterprise versions 1.14.0 up to but not including 1.16.0 have a vulnerability in the TLS certificates authentication method where OCSP responses are not correctly validated when multiple OCSP sources are configured. This issue is fixed in Vault 1.16.0 and Vault Enterprise versions 1.16.1, 1.15.7, and 1.14.11. The vulnerability has a medium severity rating and no known exploits in the wild have been reported.