Vault Community, Vault Enterprise (“Vault”) Azure Auth method did not correctly validate the claims in the Azure-issued token, resulting in the potential bypass of the bound_locations parameter on login. Fixed in Vault Community Edition 1.19.1 and Vault Enterprise 1.19.1, 1.18.7, 1.17.14, 1.16.18.
Fixes

Solution

No solution given by the vendor.


Workaround

No workaround given by the vendor.

History

Tue, 12 Aug 2025 01:45:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:hashicorp:vault:*:*:*:*:-:*:*:*
cpe:2.3:a:hashicorp:vault:*:*:*:*:enterprise:*:*:*
cpe:2.3:a:hashicorp:vault:1.19.0:*:*:*:enterprise:*:*:*

Mon, 05 May 2025 14:30:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

threat_severity

Moderate


Fri, 02 May 2025 17:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}


Fri, 02 May 2025 16:30:00 +0000

Type Values Removed Values Added
Description Vault Community, Vault Enterprise (“Vault”) Azure Auth method did not correctly validate the claims in the Azure-issued token, resulting in the potential bypass of the bound_locations parameter on login. Fixed in Vault Community Edition 1.19.1 and Vault Enterprise 1.19.1, 1.18.7, 1.17.14, 1.16.18.
Title Vault’s Azure Authentication Method bound_location Restriction Could be Bypassed on Login
Weaknesses CWE-863
References
Metrics cvssV3_1

{'score': 6.6, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H'}


cve-icon MITRE

Status: PUBLISHED

Assigner: HashiCorp

Published:

Updated: 2025-05-02T16:50:15.195Z

Reserved: 2025-04-22T17:52:28.596Z

Link: CVE-2025-3879

cve-icon Vulnrichment

Updated: 2025-05-02T16:50:09.297Z

cve-icon NVD

Status : Analyzed

Published: 2025-05-02T17:15:51.273

Modified: 2025-08-12T01:39:23.767

Link: CVE-2025-3879

cve-icon Redhat

Severity : Moderate

Publid Date: 2025-05-02T16:15:10Z

Links: CVE-2025-3879 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2025-06-23T19:32:00Z