CWE-156 vulnerabilities

Vault and Vault Enterprise’s (“Vault”) ldap auth method may not have correctly enforced MFA if username_as_alias was set to true and a user had multiple CNs that are equal but with leading or trailing spaces. Fixed in Vault Community Edition 1.20.2 and Vault Enterprise 1.20.2, 1.19.8, 1.18.13, and 1.16.24.

CVE-2025-6014 is a medium severity vulnerability in HashiCorp Vault's TOTP Secrets Engine code validation endpoint. It involves improper neutralization of whitespace, allowing code reuse within the validity period. The issue affects Vault and Vault Enterprise versions prior to the fixed releases. Official patches are available in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23.