CVE-2025-55003Medium· 5.7▾ SunlitOpenBao Login MFA Bypass of Rate Limiting and TOTP Token Reuse
▾ Sunlit zone — Low / medium · no exploitation signal
impact 31.4 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 27.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.2%
0.2% → 0.2%
OpenBao's Login Multi-Factor Authentication (MFA) system allows enforcing MFA using Time-based One Time Password (TOTP). Due to normalization applied by the underlying TOTP library, codes were accepted which could contain whitespace; this whitespace could bypass internal rate limiting of the MFA method and allow reuse of existing MFA codes.
OpenBao v2.3.2 will patch this issue.
Use of rate-limiting quotas can limit an attacker's ability to exploit this: https://openbao.org/api-docs/system/rate-limit-quotas/
This issue was disclosed to HashiCorp and is the OpenBao equivalent of the following tickets:
github.com/openbao/openbao >= 0.1.0, < 2.3.2github.com/openbao/openbao < 0.0.0-20250807113757-8340a6918f6cUpgrade to a patched release:
github.com/openbao/openbao 2.3.2github.com/openbao/openbao 0.0.0-20250807113757-8340a6918f6cConnected by shared product, vendor, weakness, or advisory.
CVE-2026-45808HighOpenBao is an open source identity-based secrets management system
CVE-2026-46358MediumOpenBao is an open source identity-based secrets management system
CVE-2026-46405Medium· 5.3OpenBao is an open source identity-based secrets management system
CVE-2025-54997Critical· 9.1Privileged OpenBao Operator May Execute Code on the Underlying Host
CVE-2026-42186LowOpenBao's Namespace Deletion May Not Delete Data Properly
CVE-2025-54996High· 7.2OpenBao Root Namespace Operator May Elevate Token Privileges