PT-2025-27552 · Onelogin · Onelogin Ad Connector

Specterops · Published 2025-06-30 · Updated 2025-07-03 · CVE-2025-34064

Positive Technologies (AI Summary)

CVSS v4.0

9.0

Critical

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions: OneLogin AD Connector (affected versions not specified)

Description: A cloud infrastructure misconfiguration in OneLogin AD Connector results in log data being sent to a hardcoded S3 bucket (onelogin-adc-logs-production) without validating bucket ownership. This allows an attacker who registers this unclaimed bucket to receive log files from other OneLogin tenants, potentially containing sensitive data such as directory tokens, user metadata, and environment configuration. This enables cross-tenant leakage of secrets, potentially allowing JWT signing key recovery and user impersonation.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-200

CWE-668

Related Identifiers

BDU:2026-00281

CVE-2025-34064

Affected Products

Onelogin Ad Connector

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2025-34064 · Security Note
• https://bdu.fstec.ru/vul/2026-00281 · Security Note
• https://twitter.com/CVEnew/status/1940067210233323870 · Twitter Post
• https://support.onelogin.com/product-notification/noti-00001768 · Patch, Vendor Advisory
• https://specterops.io/blog/2025/06/10/onelogin-many-issues-how-i-pivoted-from-a-trial-tenant-to-compromising-customer-signing-keys · Note
• https://twitter.com/gothburz/status/1940100078317805757 · Twitter Post
• https://twitter.com/CCBalert/status/1940785302987022829 · Twitter Post
• https://twitter.com/CveFindCom/status/1940065380623343674 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1940109928464613535 · Twitter Post
• https://vulncheck.com/advisories/onelogin-ad-connector-account-compromise · Note