CVE-2025-6014

What it actually does

HashiCorp Vault’s TOTP secrets engine validation endpoint does not consume a successfully checked time-based one-time password for the rest of its validity window. The same TOTP code can therefore be accepted repeatedly until the period expires, breaking the expected single-use property of TOTP used for authentication and second-factor checks.

Why it matters to the business

MFA and login flows that trust Vault TOTP can be weakened: a captured still-valid code may be reused to gain additional successful authentications. Impact is medium (CVSS 6.5), not listed in CISA KEV, not tied to ransomware, and has no known exploit maturity, with a still-low EPSS that rose only slightly. The advisory is many months old, so remaining unpatched Vault clusters are avoidable residual risk in a product that often gates secrets, certificates, and privileged access.

How an attack unfolds

An attacker who already possesses a currently valid Vault-issued TOTP code—obtained through phishing, endpoint malware, log or backup leakage, network interception, or observation—calls the TOTP code validation API and receives success. On unpatched Vault, the engine does not mark that code as used, so the attacker can present the identical code again throughout the remaining validity window and continue to receive success. Abuse requires a live code plus permission to hit the validation endpoint; no named threat actors or public exploit activity are associated with this issue.

How to fix it

Upgrade Vault Community Edition to 1.20.1 or later, or Vault Enterprise to 1.20.1, 1.19.7, 1.18.12, or 1.16.23 (or later on the same supported branch). The fix is in git commit b403b1a27c8db6038ffefb296d7be0962e08039d. Perform a standard rolling upgrade, verify cluster health, and re-enable normal TOTP use. Until patched, tighten ACLs on TOTP validation paths, shorten periods only if operations allow, and do not treat Vault TOTP as replay-resistant.

How to confirm the fix worked

Confirm every Community and Enterprise node reports a fixed version. In a non-production cluster, generate a TOTP code, validate it once (expect success), then immediately validate the same code again (expect failure after the patch). Inventory TOTP engine mounts and applications that call validation. Review Vault audit logs for totp/code activity after the upgrade.

Typical attack path

1. Obtain a currently valid TOTP code from Vault’s TOTP secrets engine
2. Reach the TOTP code validation endpoint with a token or role that is allowed to validate codes
3. Submit the captured code and receive a successful validation
4. Resubmit the same code before the validity window ends
5. Leverage repeated success to bypass single-use TOTP expectations in dependent login or MFA flows

How to detect it

There is no unique malware or file artifact. Hunt Vault audit logs for multiple successful responses on the TOTP code validation path for the same key within one TOTP period (commonly 30 seconds, sometimes longer with clock skew). Correlate duplicate success from one client token, entity, or source address, and downstream login success immediately after those events. No named actors are linked; if clusters were unpatched after 2025-08-01, review historical totp/code successes for reuse patterns.

• totp/code/
• /v1/totp/code/
• "path":"totp/code/
• request.path totp/code
• "operation":"update" with totp/code

What your security team should do

• Upgrade all Vault Community and Enterprise clusters to 1.20.1 (CE/Enterprise) or Enterprise 1.19.7, 1.18.12, or 1.16.23 as a prompt planned change
• Inventory TOTP secrets engine mounts and every app that uses Vault TOTP for login or MFA
• Restrict ACL policies on TOTP code validation paths to the minimum required identities
• Hunt Vault audit logs for the same TOTP code succeeding more than once inside one validity window
• Do not treat this as a KEV-style emergency given low EPSS and no known exploitation, but close it because Vault is high-value infrastructure
• Follow standard Vault backup and rolling-upgrade practice before patching