GHSA-j3xv-7fxp-gfhx

Source

https://github.com/advisories/GHSA-j3xv-7fxp-gfhx

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/08/GHSA-j3xv-7fxp-gfhx/GHSA-j3xv-7fxp-gfhx.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-j3xv-7fxp-gfhx

Aliases

Published

2025-08-08T14:38:54Z

Modified

2026-07-29T03:48:41Z

Severity

5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVSS Calculator

Summary

OpenBao Userpass and LDAP User Lockout Bypass

Details

Impact

Attackers could bypass the automatic user lockout mechanisms in the OpenBao Userpass or LDAP auth systems. This was caused by different aliasing between pre-flight and full login request user entity alias attributions.

Patches

OpenBao v2.3.2 will patch this issue.

Workarounds

Existing users may apply rate-limiting quotas on the authentication endpoints: https://openbao.org/api-docs/system/rate-limit-quotas/

References

This issue was disclosed to HashiCorp and is the OpenBao equivalent of the following tickets:

Database specific

{
    "cwe_ids":  [
        "CWE-307"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2025-08-08T14:38:54Z",
    "nvd_published_at":  "2025-08-09T03:15:46Z",
    "severity":  "MODERATE"
}

References

Affected packages

Go / github.com/openbao/openbao

Package

Name: github.com/openbao/openbao; View open source insights on deps.dev
Purl: pkg:golang/github.com/openbao/openbao

Affected ranges

Type: SEMVER
Events: Introduced

0.1.0

Fixed

2.3.2

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/08/GHSA-j3xv-7fxp-gfhx/GHSA-j3xv-7fxp-gfhx.json"

Go / github.com/openbao/openbao

Package

Name: github.com/openbao/openbao; View open source insights on deps.dev
Purl: pkg:golang/github.com/openbao/openbao

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.0.0-20250807212521-c52795c1ef74

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/08/GHSA-j3xv-7fxp-gfhx/GHSA-j3xv-7fxp-gfhx.json"