Threats tagged 'bit-vault-2025-6011'

CVE-2025-6011 is a timing side channel vulnerability in HashiCorp Vault's userpass authentication method that allows an attacker to distinguish between existing and non-existing usernames. This could enable username enumeration. The issue is fixed in Vault Community Edition 1.20.1 and Vault Enterprise versions 1.20.1, 1.19.7, 1.18.12, and 1.16.23. The vulnerability has a low severity score of 3.7 and does not impact confidentiality, integrity, or availability beyond username disclosure.