PT-2025-32240 · Microsoft+1 · Intune+2

Scabrero · Published 2025-08-07 · Updated 2026-04-15 · CVE-2025-54882

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Himmelblau versions 0.8.0 through 0.9.21 Himmelblau versions 1.0.0-beta through 1.1.0

Description Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. Versions 0.8.0 through 0.9.21 and 1.0.0-beta through 1.1.0 store the cloud TGT (Ticket Granting Ticket) received during logon in the Kerberos credential cache. The created credential cache collection and received credentials are stored as world readable. This issue is fixed in versions 0.9.22 and 1.2.0.

Recommendations Himmelblau versions 0.8.0 through 0.9.21: Remove all read access to Himmelblau caches for all users except for owners. Himmelblau versions 1.0.0-beta through 1.1.0: Remove all read access to Himmelblau caches for all users except for owners.

Exploit

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

CVE-2025-54882

GHSA-PHFX-RJFW-WJ83

OPENSUSE-FU-2026:20453-1

OPENSUSE-SU-2025:15425-1

SUSE-FU-2026:20990-1

SUSE-SU-2026:1361-1

Affected Products

Himmelblau

Intune

Azure Entra Id

References · 33

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54882.json · Exploit
• 🔥 https://github.com/himmelblau-idm/himmelblau/security/advisories/GHSA-phfx-rjfw-wj83 · Exploit
• https://github.com/himmelblau-idm/himmelblau/commit/b562053df3dffb1dd9ab3d09af986886773be2ad · Patch
• https://github.com/himmelblau-idm/himmelblau/commit/faae58b0384aca8b21b4be5f1c507412eec3778a · Patch
• https://osv.dev/vulnerability/openSUSE-FU-2026:20453-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-FU-2026:20990-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:1361-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15425-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-54882 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-54882 · Security Note
• https://github.com/himmelblau-idm/himmelblau/releases/tag/0.9.22 · Note
• https://github.com/himmelblau-idm/himmelblau/releases/tag/1.2.0 · Note
• https://suse.com/security/cve/CVE-2026-31979 · Note
• https://suse.com/security/cve/CVE-2025-53013 · Note
• https://t.me/CVEtracker/29412 · Telegram Post