PT-2025-27551 · Onelogin · Onelogin Ad Connector

Specterops · Published 2025-06-30 · Updated 2025-07-03 · CVE-2025-34063

Positive Technologies (AI Summary)

CVSS v4.0

10

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions: OneLogin AD Connector versions prior to 6.1.5

Description: A cryptographic authentication bypass issue exists due to the exposure of a tenant’s SSO JWT signing key via the "/api/adc/v4/configuration" endpoint. An attacker with the signing key can craft valid JWT tokens to impersonate arbitrary users within a OneLogin tenant, allowing full unauthorized access across the victim’s SaaS environment.

Recommendations: For versions prior to 6.1.5, update to version 6.1.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the "/api/adc/v4/configuration" endpoint to minimize the risk of exploitation.

Fix

Authentication Bypass by Spoofing

Weakness Enumeration

CWE-290

Related Identifiers

BDU:2026-00280

CVE-2025-34063

Affected Products

Onelogin Ad Connector

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2025-34063 · Security Note
• https://bdu.fstec.ru/vul/2026-00280 · Security Note
• https://support.onelogin.com/product-notification/noti-00001768 · Patch, Vendor Advisory
• https://twitter.com/CveFindCom/status/1940065437103935960 · Twitter Post
• https://twitter.com/CVEnew/status/1940067211638350269 · Twitter Post
• https://twitter.com/gothburz/status/1940100078317805757 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1940112488902562068 · Twitter Post
• https://specterops.io/blog/2025/06/10/onelogin-many-issues-how-i-pivoted-from-a-trial-tenant-to-compromising-customer-signing-keys · Note
• https://twitter.com/CCBalert/status/1940785302987022829 · Twitter Post
• https://vulncheck.com/advisories/onelogin-ad-connector-account-compromise · Note