A high-severity safety flaw has been disclosed within the One Identification OneLogin Identification and Entry Administration (IAM) resolution that, if efficiently exploited, may expose delicate OpenID Join (OIDC) software consumer secrets and techniques beneath sure circumstances.
The vulnerability, tracked as CVE-2025-59363, has been assigned a CVSS rating of seven.7 out of 10.0. It has been described as a case of incorrect useful resource switch between spheres (CWE-669), which causes a program to cross safety boundaries and procure unauthorized entry to confidential information or features.
CVE-2025-59363 “allowed attackers with legitimate API credentials to enumerate and retrieve consumer secrets and techniques for all OIDC purposes inside a company’s OneLogin tenant,” Clutch Safety mentioned in a report shared with The Hacker Information.
The identification safety mentioned the issue stems from the truth that the appliance itemizing endpoint – /api/2/apps – was configured to return extra information than anticipated, together with the client_secret values within the API response alongside metadata associated to the apps in a OneLogin account.
The steps to drag off the assault are listed under –
- Attacker makes use of legitimate OneLogin API credentials (consumer ID and secret) to authenticate
- Request entry token
- Name the /api/2/apps endpoint to listing all purposes
- Parse the response to retrieve consumer secrets and techniques for all OIDC purposes
- Use extracted consumer secrets and techniques to impersonate purposes and entry built-in providers
Profitable exploitation of the flaw may enable an attacker with legitimate OneLogin API credentials to retrieve consumer secrets and techniques for all OIDC purposes configured inside a OneLogin tenant. Armed with this entry, the menace actor may leverage the uncovered secret to impersonate customers and acquire entry to different purposes, providing alternatives for lateral motion.
OneLogin’s role-based entry management (RBAC) grants API keys broad endpoint entry, which means the compromised credentials may very well be used to entry delicate endpoints throughout all the platform. Compounding issues additional is the shortage of IP tackle allowlisting, on account of which it is doable for attackers to take advantage of the flaw from anyplace on this planet, Clutch famous.
Following accountable disclosure on July 18, 2025, the vulnerability was addressed in OneLogin 2025.3.0, which was launched final month by making OIDC client_secret values not seen. There is no such thing as a proof that the difficulty was ever exploited within the wild.
“Identification suppliers function the spine of enterprise safety structure,” Clutch Safety mentioned. “Vulnerabilities in these programs can have cascading results throughout complete expertise stacks, making rigorous API safety important.”
