Vault allows the Authorization header to be forwarded to authentication backends when the header is used for authenticating to Vault. The forwarded header contains the Vault token, which is mistakenly exposed to the auth plugin. This leakage of the token can enable an attacker to impersonate the user with the token's privileges. The weakness is an insecure handling of sensitive data (CWE-201), compromising confidentiality and potentially providing full access to Vault resources.

HashiCorp Vault and Vault Enterprise are affected. All releases older than 2.0.0, 1.21.5, 1.20.10, or 1.19.16 contain the vulnerability.

The vulnerability carries a CVSS score of 7.5, indicating high severity. EPSS data is not available, but public exploitation is not documented and the issue is not listed in the CISA KEV catalog. The attack requires the ability to configure an auth mount to use the Authorization header passthrough, which is typically a privilege of internal users or an attacker who compromises the configuration process. An attacker who can achieve this can retrieve a Vault token and perform unauthorized actions.