---
id: CVE-2025-6013
aliases:
  - GHSA-7rx2-769v-hrwf
  - BIT-vault-2025-6013
  - GO-2025-3848
title: HashiCorp Vault ldap auth method may not have correctly enforced MFA
summary: HashiCorp Vault ldap auth method may not have correctly enforced MFA
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N'
vendor: hashicorp
product: github.com/hashicorp/vault
ecosystem: go
affected:
  - github.com/hashicorp/vault < 1.20.2
patched:
  - github.com/hashicorp/vault 1.20.2
published: '2025-08-06'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:50:26.808788954Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-7rx2-769v-hrwf'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2025-6013'
  - url: >-
      https://discuss.hashicorp.com/t/hcsec-2025-20-vault-ldap-mfa-enforcement-bypass-when-using-username-as-alias/76092
  - url: 'https://github.com/hashicorp/vault'
tags:
  - osv
  - go
epss: 0.00502
epssPercentile: 0.41982
ingestedAt: '2026-09-12T03:13:01.765Z'
---

## Overview

Vault and Vault Enterprise’s (“Vault”) ldap auth method may not have correctly enforced MFA if username_as_alias was set to true and a user had multiple CNs that are equal but with leading or trailing spaces. Fixed in Vault Community Edition 1.20.2 and Vault Enterprise 1.20.2, 1.19.8, 1.18.13, and 1.16.24.

## Affected packages

- `github.com/hashicorp/vault < 1.20.2`

## Remediation

Upgrade to a patched release:

- `github.com/hashicorp/vault 1.20.2`