CVE-2025-3879: Hashicorp Vault

High severity, CVSS 8.8. EPSS: 0.4% chance of exploitation in the next 30 days.

Vault Community, Vault Enterprise (“Vault”) Azure Auth method did not correctly validate the claims in the Azure-issued token, resulting in the potential bypass of the bound_locations parameter on login. Fixed in Vault Community Edition 1.19.1 and Vault Enterprise 1.19.1, 1.18.7, 1.17.14, 1.16.18.

Affected products

• Hashicorp Vault: from 0.10.0, before 1.16.18 (fixed in 1.16.18); from 0.10.0, before 1.19.1 (fixed in 1.19.1); from 1.17.0, before 1.17.14 (fixed in 1.17.14); from 1.18.0, before 1.18.7 (fixed in 1.18.7); version 1.19.0 only

Published 2025-05-02. Last modified 2026-06-17.