HackZoneLabs News
Newsletter

CVE-2026-92738

Expired Vault login MFA requests may remain redeemable

  • Medium 6.8

Description

Vault's Login MFA feature did not consistently enforce the lifetime of pending two-phase login requests. This may allow a user who previously completed the first authentication factor to complete MFA and obtain a Vault token after the pending request should have expired, including after the user's primary credential has been rotated. This vulnerability (CVE-2026-92738) is fixed in Vault Community Edition 2.2.2 and Vault Enterprise 2.2.2, 1.21.14, and 1.19.26.

Key facts

Published
13 Nov 2026
Last changed
13 Nov 2026
Assigned by
HashiCorp
EPSS
0.308% likely to be exploited in the next 30 days, higher than 24.003% of CVEs (scores for 15 Nov 2026)
SSVC (CISA)
Exploitation: none; Automatable: no; Technical impact: total

Severity scores

Each score is shown as its source gave it. They are not averaged or merged.

  • 6.8CVSS 3.1, Mediumfrom the CNA (HashiCorp)CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Historical context and remediation

This reference retains the original CVE publication date. A recent record update does not mean a new attack occurred.

CAPEC-60: Reusing Session IDs (Session Replay) (CNA impact statement)

No explicit remediation statement is available on this page yet. Consult the original record and vendor references before choosing a fix.

Version statuses below come from the CNA. An “unaffected” version is not necessarily a currently supported release or proof of a patch date. EPSS is a dated risk estimate, not a count of historical attacks.

Read the original CVE record.

Affected products

VendorProductVersions
HashiCorpVault
  • Default status: unaffected
  • 1.10.0 up to but excluding 2.2.2 (affected)
HashiCorpVault Enterprise
  • Default status: unaffected
  • 1.10.0 up to but excluding 2.2.2 (affected); at 1.19.26 unaffected, at 1.20.0 affected, at 1.21.14 unaffected, at 2.0.0 affected

Timeline

  1. 13 Nov 2026 Published

Weakness

References