Vulnerability · Published Aug 9, 2025 · Assigned by GitHub_M
CVE-2025-55000OpenBao TOTP Secrets Engine Enables Code Reuse
Medium 6.5
In plain English
A medium-severity security flaw in openbao from openbao. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In versions 0.1.0 through 2.3.1, OpenBao's TOTP secrets engine could accept valid codes multiple times rather than strictly-once. This was caused by unexpected normalization in the underlying TOTP library. To work around, ensure that all codes are first normalized before submitting to the OpenBao endpoint. TOTP code verification is a privileged action; only trusted systems should be verifying codes.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.22 | openbao | 2.3.2-r0 | ALPINE-CVE-2025-55000 |
| Alpine:v3.23 | openbao | 2.3.2-r0 | ALPINE-CVE-2025-55000 |
| Alpine:v3.24 | openbao | 2.3.2-r0 | ALPINE-CVE-2025-55000 |
| Go | github.com/openbao/openbao | 2.3.2 | GHSA-f7c3-mhj2-9pvg |
| Go | github.com/openbao/openbao | 0.0.0-20250806193153-183891f8d535 | GHSA-f7c3-mhj2-9pvg |
| Go | github.com/openbao/openbao | 0.0.0-20250806193153-183891f8d535 | GO-2025-3853 |
Affected products (as reported)
Weakness: CWE-156 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N