VULNERABILITY INTELLIGENCE

CVE-2025-3879

CVSS score6.6 MEDIUM
EPSS probability0.44%
CISA KEVNot currently listed
Published2025-05-02
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Description

Vault Community, Vault Enterprise (“Vault”) Azure Auth method did not correctly validate the claims in the Azure-issued token, resulting in the potential bypass of the bound_locations parameter on login. Fixed in Vault Community Edition 1.19.1 and Vault Enterprise 1.19.1, 1.18.7, 1.17.14, 1.16.18.

Weakness classification

  • CWE-863: Incorrect Authorization

Primary references