Local Privilege Escalation in One Identity Password Manager via Flawed Security Mechanism

CVE-2025-27582

What is CVE-2025-27582?

The Secure Password extension in One Identity Password Manager is affected by a vulnerability that allows local privilege escalation due to an inadequate security hardening mechanism in the kiosk browser. This flaw enables an attacker with access to the Password Self-Service site from the lock screen to create a malicious webpage. By utilizing the Help function, the attacker can execute a script that overrides the security measures meant to prevent privileged actions. This can lead to the invocation of the SYSTEM-level print dialog, allowing the attacker to leverage standard Windows functionalities to gain complete control of the system.

References