{"id":"CVE-2025-13357","revision":"3fe9b2771b5b46daa260109d9c401143","records":[{"revision":"3fe9b2771b5b46daa260109d9c401143","observedAt":"2026-10-25T01:17:29.167+00:00","statement":{"source":"nvd","id":"CVE-2025-13357","aliases":[],"title":"Vault’s Terraform Provider incorrectly set the default deny_null_bind parameter for the LDAP auth method to false by default, potentially resulting in an insecure configuration. If the underlying LDAP server allowed anonymous or unauthentic…","description":"Vault’s Terraform Provider incorrectly set the default deny_null_bind parameter for the LDAP auth method to false by default, potentially resulting in an insecure configuration. If the underlying LDAP server allowed anonymous or unauthenticated binds, this could result in authentication bypass. This vulnerability, CVE-2025-13357, is fixed in Vault Terraform Provider v5.5.0.","state":0,"publishedAt":"2025-11-21T15:15:51.313+00:00","modifiedAt":"2026-10-08T10:10:00.227+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security@hashicorp.com · Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","score":7.4,"severity":"HIGH"},{"system":"CVSS 3.1 · nvd@nist.gov · Primary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8,"severity":"CRITICAL"}],"references":["https://discuss.hashicorp.com/t/hcsec-2025-33-vault-terraform-provider-applied-incorrect-defaults-for-ldap-auth-method/76822"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-13357","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Analyzed","weaknesses":["CWE-1188"],"productCriteria":["cpe:2.3:a:hashicorp:terraform_provider:*:*:*:*:*:vault:*:*"],"sourceDates":{"published":"2025-11-21T15:15:51.313","lastModified":"2026-10-08T10:10:00.227"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2025-13357","identifiers":["CVE-2025-13357"]},"retained":false,"historicalAffected":[]}],"coverage":[]}