Read the docs
TI-2025-24232 Aliases CVE-2025-34064GHSA-p59x-w56c-2jj2

OneLogin AD Connector Log S3 Bucket Hijack Leading to Cross-Tenant Data Leakage

Priority HIGH 78CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Information disclosure
Confidentiality · integrity · availability
High · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-200.

Summary

A cloud infrastructure misconfiguration in OneLogin AD Connector results in log data being sent to a hardcoded S3 bucket (onelogin-adc-logs-production) without validating bucket ownership. An attacker who registers this unclaimed bucket can begin receiving log files from other OneLogin tenants. These logs may contain sensitive data such as directory tokens, user metadata, and environment configuration. This enables cross-tenant leakage of secrets, potentially allowing JWT signing key recovery and user impersonation.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00529 44th percentileScored 2026-11-07
Fix Fixed OneLogin Active Directory Connector (ADC) (One Identity): 6.1.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
One IdentityOneLogin Active Directory Connector (ADC)before 6.1.56.1.5Patch availableCNA
  • OneLogin Active Directory Connector (ADC) VendorOne Identity Affected before 6.1.5 Fixed in 6.1.5 Patch available CNA

Remediation

  • Fix · CNA OneLogin Active Directory Connector (ADC) (One Identity) Fixed in 6.1.5

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    One Identity OneLogin Active Directory Connector (ADC) — support.onelogin.com/product-notification/noti-00001768

    3 records Highest priority Priority HIGH 2 HIGH, 1 LOW

    Other records, highest priority first

    • TI-2025-24231 OneLogin AD Connector JWT Authentication Bypass via Exposed Signing KeyPriority HIGH 82
    • TI-2025-24230 OneLogin AD Connector API Credential and Signing Key ExposurePriority LOW 31
    Show all 3 records → Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-34064
  2. 2026-10-03 Alias added: GHSA-p59x-w56c-2jj2

References

Patch 1

Other 1

  • TI-2025-24231 OneLogin AD Connector JWT Authentication Bypass via Exposed Signing Key CVSS 4.0CRITICAL 10.0
  • TI-2023-28400 One Identity Password Manager before 5.13.1 allows Kiosk Escape. CVSS 3.1HIGH 8.8
  • TI-2024-31899 tranport: TLS host name wildcard matching too lax CVSS 3.1HIGH 7.5
  • TI-2025-20397 The Secure Password extension in One Identity Password Manager before 5.14.4 allows local… CVSS 3.1HIGH 7.6
  • TI-2025-32958 SQL injection in OneLogin CVSS 3.1MEDIUM 4.0
  • TI-2024-37336 In One Identity Identity Manager 9.x before 9.3, an insecure direct object reference… CVSS 3.1CRITICAL 9.9
See all 20 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences