{"id":"CVE-2025-3879","aliases":["BIT-vault-2025-3879","EUVD-2025-13121","GHSA-f9ch-h8j7-8jwg","GO-2025-3662","openSUSE-SU-2025:15059-1"],"status":"published","title":"Vault’s Azure Authentication Method bound_location Restriction Could be Bypassed on Login","description":"Vault Community, Vault Enterprise (“Vault”) Azure Auth method did not correctly validate the claims in the Azure-issued token, resulting in the potential bypass of the bound_locations parameter on login. Fixed in Vault Community Edition 1.19.1 and Vault Enterprise 1.19.1, 1.18.7, 1.17.14, 1.16.18.","severity":{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00445,"percentile":0.39176,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-863"],"published":"2025-05-02T16:15:10Z","modified":"2026-10-28T02:30:45Z","fixes":[{"ecosystem":"Go","package":"github.com/hashicorp/vault","fixed_in":["1.19.1"],"sources":["ghsa","osv"]},{"ecosystem":"Bitnami","package":"vault","fixed_in":["1.19.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/hashicorp/vault","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.10.0"},{"fixed":"1.19.1"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"vault","ranges":[{"type":"SEMVER","events":[{"introduced":"0.10.0"},{"fixed":"1.19.1"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/hashicorp/vault","ranges":[{"type":"SEMVER","events":[{"introduced":"1.10.0"},{"fixed":"1.19.1"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/hashicorp/vault","ranges":[{"type":"SEMVER","events":[{"introduced":"1.10.0"},{"fixed":"1.19.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20250506T153719-1.1"}]}],"bundled":12}],"products":[{"vendor":"hashicorp","product":"vault"},{"vendor":"hashicorp","product":"vault enterprise"}],"references":[{"url":"https://discuss.hashicorp.com/t/hcsec-2025-07-vault-s-azure-authentication-method-bound-location-restriction-could-be-bypassed-on-login/74716","tags":["Vendor Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-3879","tags":["web","advisory"]},{"url":"https://pkg.go.dev/vuln/GO-2025-3662","tags":["web"]},{"url":"https://github.com/advisories/GHSA-f9ch-h8j7-8jwg","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/3xxx/CVE-2025-3879.json","tags":["advisory"]},{"url":"https://github.com/hashicorp/vault","tags":["package"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/HNV7O7SNYYY4AFS5HKAPLITKK3B57LE7/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11243","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-32198","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-22031","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-23390","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-32777","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-3879","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-4166","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-4210","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-46327","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-46342","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-46569","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-46599","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2025-3879","title":"Vault’s Azure Authentication Method bound_location Restriction Could be Bypassed on Login","description":"Vault Community, Vault Enterprise (“Vault”) Azure Auth method did not correctly validate the claims in the Azure-issued token, resulting in the potential bypass of the bound_locations parameter on login. Fixed in Vault Community Edition 1.19.1 and Vault Enterprise 1.19.1, 1.18.7, 1.17.14, 1.16.18.","status":"published","published":"2025-05-02T16:15:10.65Z","modified":"2025-05-02T16:50:15.195Z","cvss":[{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:32:39.719629Z"}],"euvd":[{"id":"EUVD-2025-13121","description":"Vault Community, Vault Enterprise (“Vault”) Azure Auth method did not correctly validate the claims in the Azure-issued token, resulting in the potential bypass of the bound_locations parameter on login. Fixed in Vault Community Edition 1.19.1 and Vault Enterprise 1.19.1, 1.18.7, 1.17.14, 1.16.18.","status":"published","published":"2025-05-02T16:15:10Z","modified":"2025-05-02T16:50:15Z","cvss":[{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T20:51:55.85045Z"}],"ghsa":[{"id":"GHSA-f9ch-h8j7-8jwg","title":"Hashicorp Vault Community vulnerable to Incorrect Authorization","description":"Vault Community, Vault Enterprise (“Vault”) Azure Auth method did not correctly validate the claims in the Azure-issued token, resulting in the potential bypass of the bound_locations parameter on login. Fixed in Vault Community Edition 1.19.1 and Vault Enterprise 1.19.1, 1.18.7, 1.17.14, 1.16.18.","status":"published","published":"2025-05-02T18:31:38Z","modified":"2025-05-06T19:12:49Z","cvss":[{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:38:42.263728Z"}],"nvd":[{"id":"CVE-2025-3879","description":"Vault Community, Vault Enterprise (“Vault”) Azure Auth method did not correctly validate the claims in the Azure-issued token, resulting in the potential bypass of the bound_locations parameter on login. Fixed in Vault Community Edition 1.19.1 and Vault Enterprise 1.19.1, 1.18.7, 1.17.14, 1.16.18.","status":"published","published":"2025-05-02T17:15:51.273Z","modified":"2026-06-17T09:20:51.07Z","cvss":[{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:11:04.33372Z"}],"osv":[{"id":"CVE-2025-3879","title":"Vault’s Azure Authentication Method bound_location Restriction Could be Bypassed on Login","description":"Vault Community, Vault Enterprise (“Vault”) Azure Auth method did not correctly validate the claims in the Azure-issued token, resulting in the potential bypass of the bound_locations parameter on login. Fixed in Vault Community Edition 1.19.1 and Vault Enterprise 1.19.1, 1.18.7, 1.17.14, 1.16.18.","status":"published","published":"2025-05-02T16:15:10.65Z","modified":"2026-10-28T02:30:45.30832Z","cvss":[{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T15:44:49.052395Z"},{"id":"GHSA-f9ch-h8j7-8jwg","title":"Hashicorp Vault Community vulnerable to Incorrect Authorization","description":"Vault Community, Vault Enterprise (“Vault”) Azure Auth method did not correctly validate the claims in the Azure-issued token, resulting in the potential bypass of the bound_locations parameter on login. Fixed in Vault Community Edition 1.19.1 and Vault Enterprise 1.19.1, 1.18.7, 1.17.14, 1.16.18.","status":"published","published":"2025-05-02T18:31:38Z","modified":"2025-05-07T06:27:15.333758Z","cvss":[{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T15:46:46.39441Z"},{"id":"BIT-vault-2025-3879","title":"Vault’s Azure Authentication Method bound_location Restriction Could be Bypassed on Login","description":"Vault Community, Vault Enterprise (“Vault”) Azure Auth method did not correctly validate the claims in the Azure-issued token, resulting in the potential bypass of the bound_locations parameter on login. Fixed in Vault Community Edition 1.19.1 and Vault Enterprise 1.19.1, 1.18.7, 1.17.14, 1.16.18.","status":"published","published":"2025-05-07T05:56:52.014Z","modified":"2026-09-08T08:48:21.380803558Z","updated_at":"2026-11-02T15:28:36.104787Z"},{"id":"GO-2025-3662","title":"Hashicorp Vault Community vulnerable to Incorrect Authorization in github.com/hashicorp/vault","description":"Hashicorp Vault Community vulnerable to Incorrect Authorization in github.com/hashicorp/vault","status":"published","published":"2025-05-06T15:37:19Z","modified":"2025-05-07T06:27:15.333758Z","updated_at":"2026-11-02T15:47:01.728182Z"},{"id":"openSUSE-SU-2025:15059-1","title":"govulncheck-vulndb-0.0.20250506T153719-1.1 on GA media","description":"These are all security issues fixed in the govulncheck-vulndb-0.0.20250506T153719-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-05-07T00:00:00Z","modified":"2026-03-23T04:53:21.981835Z","updated_at":"2026-11-02T16:58:37.399567Z"}]}}