CVE-2025-55000Medium· 6.5▾ SunlitOpenBao TOTP Secrets Engine Code Reuse
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 27.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.2%
0.2% → 0.2%
OpenBao's TOTP secrets engine could accept valid codes multiple times rather than strictly-once. This was caused by unexpected normalization in the underlying TOTP library.
OpenBao v2.3.2 will patch this issue.
In patching, codes which were not normalized (strictly N numeric digits) will now be rejected. This is a potentially breaking change.
TOTP code verification is a privileged action; only trusted systems should be verifying codes. Ensure that all codes are first normalized before submitting to the OpenBao endpoint.
This issue was disclosed to HashiCorp and is the OpenBao equivalent of the following tickets:
github.com/openbao/openbao >= 0.1.0, < 2.3.2github.com/openbao/openbao < 0.0.0-20250806193153-183891f8d535Upgrade to a patched release:
github.com/openbao/openbao 2.3.2github.com/openbao/openbao 0.0.0-20250806193153-183891f8d535Connected by shared product, vendor, weakness, or advisory.
CVE-2026-45808HighOpenBao is an open source identity-based secrets management system
CVE-2026-46358MediumOpenBao is an open source identity-based secrets management system
CVE-2026-46405Medium· 5.3OpenBao is an open source identity-based secrets management system
CVE-2025-54997Critical· 9.1Privileged OpenBao Operator May Execute Code on the Underlying Host
CVE-2026-42186LowOpenBao's Namespace Deletion May Not Delete Data Properly
CVE-2025-54996High· 7.2OpenBao Root Namespace Operator May Elevate Token Privileges