# HCSEC-2025-07 - Vault’s Azure Authentication Method bound\_location Restriction Could be Bypassed on Login

**URL:** <https://discuss.hashicorp.com/t/hcsec-2025-07-vault-s-azure-authentication-method-bound-location-restriction-could-be-bypassed-on-login/74716>\
**Category:** Security\
**Tags:** security-vault\
**Created:** [May 2, 2025, 2:52pm UTC](https://discuss.hashicorp.com/t/hcsec-2025-07-vault-s-azure-authentication-method-bound-location-restriction-could-be-bypassed-on-login/74716 "2025-05-02T14:52:34Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![mickael](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/mickael/32/20186_2.png) [@mickael](https://discuss.hashicorp.com/u/mickael)\
**Post date:** [May 2, 2025, 2:52pm UTC](https://discuss.hashicorp.com/t/hcsec-2025-07-vault-s-azure-authentication-method-bound-location-restriction-could-be-bypassed-on-login/74716/1 "2025-05-02T14:52:34Z")

</div>

**Bulletin ID:** HCSEC-2025-07  
**Affected Products / Versions:** Vault Community Edition from 0.10.0 up to 1.19.0, fixed in 1.19.1.  
Vault Enterprise from 0.10.0 up to 1.19.0, 1.18.6, 1.17.13, 1.16.17, fixed in 1.19.1, 1.18.7, 1.17.14, 1.16.18.

**Publication Date:** May 2, 2025

**Summary**  
Vault Community, Vault Enterprise (“Vault”) Azure Auth method did not correctly validate the claims in the Azure-issued token, resulting in the potential bypass of the bound\_locations parameter on login. This vulnerability, identified as CVE-2025-3879, is fixed in Vault Community Edition 1.19.1 and Vault Enterprise 1.19.1, 1.18.7, 1.17.14, 1.16.18.

**Background**  
The [Azure auth method](https://developer.hashicorp.com/vault/docs/auth/azure) authenticates users or machines to Vault using an assertion signed by Azure Active Directory for a configured tenant.

The Azure auth method’s [bound\_locations](https://developer.hashicorp.com/vault/api-docs/auth/azure#bound_locations) parameter can be set by an operator to enforce geographical restrictions for logins to Vault.

**Details**  
The user-provided vm\_name or vmss\_name login parameters were not validated against the Azure-issued token claims. Setting a vm\_name or vmss\_name that would satisfy the login requirements could be used to bypass the bound\_location restriction.

The Azure auth method will now require the user-provided resource\_group\_name, vm\_name, vmss\_name parameters to match the Azure AD token claims on login. More information can be found in [Azure - Auth Methods | Vault | HashiCorp Developer](https://developer.hashicorp.com/vault/docs/auth/azure#token-validation).

**Remediation**  
Customers should evaluate the risk associated with this issue and consider upgrading to Vault 1.19.1, 1.18.7, 1.17.14, 1.16.18, or newer. Please refer to [Upgrading Vault](https://developer.hashicorp.com/vault/docs/upgrading) for general guidance.

**Acknowledgement**  
This issue was identified by HashiCorp’s external security assessment partner.

_We deeply appreciate any effort to coordinate disclosure of security vulnerabilities. For information about security at HashiCorp and the reporting of security vulnerabilities, please see [https://hashicorp.com/security](https://hashicorp.com/security)._