CVE-2025-62513: OpenBao leaks HTTPRawBody in Audit Logs

OpenBao’s audit log experienced a regression wherein raw HTTP bodies used by few endpoints were not correctly redacted (HMAC’d). This impacted the following subsystems:

• When using the ACME functionality of PKI, this would result in short-lived ACME verification challenge codes being leaked in the audit logs.
• When using the OIDC issuer functionality of the identity subsystem, auth and token response codes along with claims could be leaked in the audit logs.

Third-party plugins may be affected.