CVE-2025-3879 Information
May 03, 2025
cve
Description
Vault Community Vault Enterprise (“Vault”) Azure Auth method did not correctly validate the claims in the Azure-issued token resulting in the potential bypass of the bound_locations parameter on login. Fixed in Vault Community Edition 1.19.1 and Vault Enterprise 1.19.1 1.18.7 1.17.14 1.16.18.