HashiCorp Vault userpass TOTP MFA brute-force and one-time-use bypass

Successful exploitation can weaken or bypass TOTP MFA protections in Vault’s userpass authentication flow. The described issues enable attackers to enumerate whether a passcode has already been used, evade one-time-use enforcement for TOTP values, and bypass or reduce the effectiveness of rate limiting, thereby increasing the feasibility of brute-forcing MFA codes within their validity window. Depending on the target environment and chained conditions, this can facilitate unauthorized authentication and subsequent access to protected Vault resources.

Until patching is complete, monitor for anomalous MFA activity, including repeated TOTP failures, suspicious timing patterns, and attempts involving entity switching or malformed/passcode-padded inputs. Review authentication logs for signs of brute-force behavior and enforce additional compensating controls around Vault access where possible. The available context does not provide more specific vendor mitigation guidance.

Upgrade HashiCorp Vault to a vendor-patched version that addresses CVE-2025-6016. The provided context states that the vulnerabilities were patched in coordination with HashiCorp. Organizations should also review MFA-related configurations and authentication workflows to ensure patched behavior is deployed consistently across affected instances.