Read the docs
TI-2025-24231 Aliases CVE-2025-34063GHSA-g2mv-fq56-3w42

OneLogin AD Connector JWT Authentication Bypass via Exposed Signing Key

Priority HIGH 82CWE-290Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-290.

Summary

A cryptographic authentication bypass vulnerability exists in OneLogin AD Connector prior to 6.1.5 due to the exposure of a tenant’s SSO JWT signing key via the /api/adc/v4/configuration endpoint. An attacker in possession of the signing key can craft valid JWT tokens impersonating arbitrary users within a OneLogin tenant. The tokens allow authentication to the OneLogin SSO portal and all downstream applications federated via SAML or OIDC. This allows full unauthorized access across the victim’s SaaS environment.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00612 49th percentileScored 2026-11-07
Fix Fixed OneLogin Active Directory Connector (ADC) (One Identity): 6.1.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
One IdentityOneLogin Active Directory Connector (ADC)before 6.1.56.1.5Patch availableCNA
  • OneLogin Active Directory Connector (ADC) VendorOne Identity Affected before 6.1.5 Fixed in 6.1.5 Patch available CNA

Remediation

  • Fix · CNA OneLogin Active Directory Connector (ADC) (One Identity) Fixed in 6.1.5

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    One Identity OneLogin Active Directory Connector (ADC) — support.onelogin.com/product-notification/noti-00001768

    3 records Highest priority Priority HIGH 2 HIGH, 1 LOW

    Other records, highest priority first

    • TI-2025-24232 OneLogin AD Connector Log S3 Bucket Hijack Leading to Cross-Tenant Data LeakagePriority HIGH 78
    • TI-2025-24230 OneLogin AD Connector API Credential and Signing Key ExposurePriority LOW 31
    Show all 3 records → Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-34063
  2. 2026-10-03 Alias added: GHSA-g2mv-fq56-3w42

References

Patch 1

Other 1

  • TI-2025-24232 OneLogin AD Connector Log S3 Bucket Hijack Leading to Cross-Tenant Data Leakage CVSS 4.0CRITICAL 9.0
  • TI-2023-28400 One Identity Password Manager before 5.13.1 allows Kiosk Escape. CVSS 3.1HIGH 8.8
  • TI-2024-31899 tranport: TLS host name wildcard matching too lax CVSS 3.1HIGH 7.5
  • TI-2025-20397 The Secure Password extension in One Identity Password Manager before 5.14.4 allows local… CVSS 3.1HIGH 7.6
  • TI-2025-32958 SQL injection in OneLogin CVSS 3.1MEDIUM 4.0
  • TI-2024-37336 In One Identity Identity Manager 9.x before 9.3, an insecure direct object reference… CVSS 3.1CRITICAL 9.9
See all 20 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences