A vulnerability in Vault Community Edition and Vault Enterprise caused client tokens and token accessors to be logged in plaintext in audit logs due to removal of HMAC protection. This regression affects versions 1.16.7 through 1.16.8 and 1.17.3 through 1.17.4. The issue was fixed in versions 1.16.9 and 1.17.5. The vulnerability has medium severity and no known exploits in the wild.