GO-2025-3783: OpenBao allows cancellation of root rekey and recovery rekey operations without authentication in github.com/openbao/openbao

  GO-2025-3853: OpenBao TOTP Secrets Engine Code Reuse in github.com/openbao/openbao

  GO-2025-3854: OpenBao has a Timing Side-Channel in the Userpass Auth Method in github.com/openbao/openbao

  GO-2025-3855: OpenBao Userpass and LDAP User Lockout Bypass in github.com/openbao/openbao

  GO-2025-3856: OpenBao Login MFA Bypass of Rate Limiting and TOTP Token Reuse in github.com/openbao/openbao

  GO-2025-3857: OpenBao Root Namespace Operator May Elevate Token Privileges in github.com/openbao/openbao

  GO-2025-3858: Privileged OpenBao Operator May Execute Code on the Underlying Host in github.com/openbao/openbao

  GO-2025-3859: OpenBao LDAP MFA Enforcement Bypass When Using Username As Alias in github.com/openbao/openbao

  GO-2025-4039: OpenBao has potential Denial of Service vulnerability when processing malicious unauthenticated JSON requests in github.com/openbao/openbao