CVE-2025-3879
Vault’s Azure Authentication Method bound_location Restriction Could be Bypassed on Login
Summary
Vault’s Azure Authentication Method bound_location Restriction Could be Bypassed on Login
Original description
The description as published by the source.
Vault Community, Vault Enterprise (“Vault”) Azure Auth method did not correctly validate the claims in the Azure-issued token, resulting in the potential bypass of the bound_locations parameter on login. Fixed in Vault Community Edition 1.19.1 and Vault Enterprise 1.19.1, 1.18.7, 1.17.14, 1.16.18.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Affected packages
Bitnami
vault
[{"type":"SEMVER","events":[{"introduced":"0.10.0"},{"fixed":"1.19.1"}]}]
References
- advisory nvd.nist.gov
- advisory github.com
- package github.com
- web discuss.hashicorp.com