{"affected":[{"defaultStatus":"unaffected","platforms":["64 bit","32 bit","x86","ARM","MacOS","Windows","Linux"],"product":"Vault","source":"CNA: HashiCorp","vendor":"HashiCorp","versions":[{"lessThan":"2.2.2","status":"affected","version":"1.10.0","versionType":"semver"}]},{"defaultStatus":"unaffected","platforms":["64 bit","32 bit","x86","ARM","MacOS","Windows","Linux"],"product":"Vault Enterprise","source":"CNA: HashiCorp","vendor":"HashiCorp","versions":[{"changes":[{"at":"1.19.26","status":"unaffected"},{"at":"1.20.0","status":"affected"},{"at":"1.21.14","status":"unaffected"},{"at":"2.0.0","status":"affected"}],"lessThan":"2.2.2","status":"affected","version":"1.10.0","versionType":"semver"}]}],"cveId":"CVE-2026-92738","cwes":["CWE-613"],"description":"Vault's Login MFA feature did not consistently enforce the lifetime of pending two-phase login requests. This may allow a user who previously completed the first authentication factor to complete MFA and obtain a Vault token after the pending request should have expired, including after the user's primary credential has been rotated. This vulnerability (CVE-2026-92738) is fixed in Vault Community Edition 2.2.2 and Vault Enterprise 2.2.2, 1.21.14, and 1.19.26.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":6.8,"severity":"medium","source":"CNA: HashiCorp","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"}],"modifiedAt":1794604175483,"publishedAt":1794601410733,"references":[{"source":"CNA: HashiCorp","tags":[],"url":"https://discuss.hashicorp.com/t/hcsec-2026-59-expired-vault-login-mfa-requests-may-remain-redeemable/78257"}],"remediation":[],"revision":"d033e00b63e53c519386c61d1f3dec56c17033137177d85f3672b28c83f546d9","sources":[{"modifiedAt":1794604175483,"name":"CNA: HashiCorp","retrievedAt":1794607806352,"url":"https://www.cve.org/CVERecord?id=CVE-2026-92738"}],"ssvc":{"assessedAt":1794604167624,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"total"},"status":"published","title":"Expired Vault login MFA requests may remain redeemable","updatedAt":1794607806352}