Lack of protection against brute force attacks In github.com/openbao/openbao
Description
OpenBao Login MFA Bypass of Rate Limiting and TOTP Token Reuse
Impact
OpenBao's Login Multi-Factor Authentication (MFA) system allows enforcing MFA using Time-based One Time Password (TOTP). Due to normalization applied by the underlying TOTP library, codes were accepted which could contain whitespace; this whitespace could bypass internal rate limiting of the MFA method and allow reuse of existing MFA codes.
Patches
OpenBao v2.3.2 will patch this issue.
Workarounds
Use of rate-limiting quotas can limit an attacker's ability to exploit this: https://openbao.org/api-docs/system/rate-limit-quotas/
References
This issue was disclosed to HashiCorp and is the OpenBao equivalent of the following tickets:
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 go | 2.3.2, 0.0.0-20250807113757-8340a6918f6c |
Aliases
References