CVE-2025-55000 OpenBao TOTP Secrets Engine Enables Code Reuse
OpenBao's TOTP engine allows code reuse due to normalization flaws, enabling attackers to bypass single-use restrictions if they can submit valid codes.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-55000?
CVE-2025-55000 is a medium-severity vulnerability in openbao, published on 9 Aug 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In versions 0.1.0 through 2.3.1, OpenBao's TOTP secrets engine could accept valid codes multiple times rather than strictly-once. This was caused by unexpected normalization in the underlying TOTP library. To work around, ensure that all codes are first normalized before submitting to the OpenBao endpoint. TOTP code verification is a privileged action; only trusted systems should be verifying codes.
Weakness: CWE-156
Which versions are affected by CVE-2025-55000?
6 open source packages ship an affected version, including github.com/openbao/openbao and openbao. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/openbao/openbao Go | All versions | 0.0.0-20250806193153-183891f8d535 |
github.com/openbao/openbao Go | All versions | 0.0.0-20250806193153-183891f8d535 |
github.com/openbao/openbao Go | All versions | 0.0.0-20250806193153-183891f8d535 |
github.com/openbao/openbao Go | From 0.1.0 | 2.3.2 |
github.com/openbao/openbao Go | From 0.1.0 | 2.3.2 |
openbao Bitnami | All versions | 0.0.0-20250806193153-183891f8d535, 2.3.2 |
Products include Openbao Openbao.
How do I fix CVE-2025-55000?
Upgrade github.com/openbao/openbao to a fixed version for your release line: 0.0.0-20250806193153-183891f8d535 or 2.3.2.
Is CVE-2025-55000 being exploited?
There is no known exploitation of CVE-2025-55000 in the wild and no public exploit code.
Other vulnerabilities in openbao
- CVE-2026-33757 OpenBao lacks user confirmation for OIDC direct callback mode
- CVE-2026-33758 OpenBao has Reflected XSS in its OIDC authentication error message
- CVE-2025-54997 OpenBao: Privileged Operator May Execute Code on the Underlying Host
- CVE-2025-64761 OpenBao Privileged Operator Identity Group Root Escalation
- CVE-2025-59043 OpenBao vulnerable to denial of service via malicious JSON request processing
Sources
Also known as BIT-openbao-2025-55000, GHSA-f7c3-mhj2-9pvg, GO-2025-3853.