---
id: CVE-2025-62513
aliases:
  - GHSA-ghfh-fmx4-26h8
  - BIT-openbao-2025-62513
  - GO-2025-4049
title: OpenBao leaks HTTPRawBody in Audit Logs
summary: OpenBao leaks HTTPRawBody in Audit Logs
severity: medium
vendor: openbao
product: github.com/openbao/openbao
ecosystem: go
affected:
  - >-
    github.com/openbao/openbao >= 0.0.0-20241114205727-b1235e585db7, <
    0.0.0-20251022165510-cc2c476bac66
patched:
  - github.com/openbao/openbao 0.0.0-20251022165510-cc2c476bac66
published: '2025-10-22'
updated: '2026-07-27'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-ghfh-fmx4-26h8'
references:
  - url: 'https://github.com/openbao/openbao/security/advisories/GHSA-ghfh-fmx4-26h8'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2025-62513'
  - url: >-
      https://github.com/openbao/openbao/commit/cc2c476bac66e1d94776c2629793daec3af625f8
  - url: 'https://github.com/openbao/openbao'
tags:
  - osv
  - go
epss: 0.00316
epssPercentile: 0.21911
ingestedAt: '2026-07-27T19:08:54.778Z'
---

## Overview

### Impact

OpenBao's audit log experienced a regression wherein raw HTTP bodies used by few endpoints were not correctly redacted (HMAC'd).  This impacted the following subsystems:

 - When using the ACME functionality of PKI, this would result in short-lived ACME verification challenge codes being leaked in the audit logs.
 - When using the OIDC issuer functionality of the identity subsystem, auth and token response codes along with claims could be leaked in the audit logs.

Third-party plugins may be affected.

### Patches

OpenBao v2.4.2 will patch this issue.

### Workarounds

If users do not use the above functionality, they are not impacted. ACME verification codes are not usable after verification or challenge expiry so are of limited long-term use.

## Affected packages

- `github.com/openbao/openbao >= 0.0.0-20241114205727-b1235e585db7, < 0.0.0-20251022165510-cc2c476bac66`

## Remediation

Upgrade to a patched release:

- `github.com/openbao/openbao 0.0.0-20251022165510-cc2c476bac66`