HashiCorp Vault and Vault Enterprise MFA Rate Limit Bypass and TOTP Token Reuse Vulnerability

A vulnerability exists in HashiCorp Vault and Vault Enterprise that allows for bypassing login multi-factor authentication (MFA) rate limits and reusing Time-based One-Time Password (TOTP) tokens. This issue is present in Vault Community Edition versions 1.10.0 prior to 1.20.0 and Vault Enterprise versions 1.10.0 prior to 1.20.0, 1.19.6, 1.18.11, 1.16.22, and 1.15.15. The vulnerability arises because Vault's login MFA did not properly normalize TOTP codes before enforcing the once-per-validity-window check, enabling an attacker to resubmit a previously used code during the MFA verification process.

Impact

Exploitation of this vulnerability allows for the bypass of MFA rate limits and the reuse of TOTP tokens, potentially leading to unauthorized access.

Remediation

Users are advised to upgrade to Vault Community Edition 1.20.1 or Vault Enterprise 1.20.1, 1.19.7, 1.18.12, or 1.16.23.